Recruitment Privacy Notice


Effective Date: 28.11.2022


Version: 2.0






Autograph Care (“we” “our” “us”) is a data controller and responsible for deciding how we collect, store and process personal data on individuals we interact with. This also includes any candidates who apply to any of our job vacancies. This privacy notice also applies to members of our group organisation which includes:


  • Walton Manor Care Home
  • Monson Care Home
  • Inwood House Care Home
  • Stoneswood Retirement Home


Each member of our group organisation is considered a separate data controller and not joint controllers with each other or with Autograph Care head office.


This recruitment privacy notice is designed to ensure any job applicants are aware of how and why personal data will be used for recruitment purposes, for how long it will be retained for and where any recruitment data may be shared to name as a few examples.


We have designed this recruitment privacy notice in accordance with requirements under the UK GDPR. This notice will be reviewed and updated where changes in legislation may occur.


You contact our head office using the following details:




c/o Browne Jacobson

Victoria House

Victoria Square


B2 4BU


Care enquiries: 0121 222 9574

Care questions:


Careers line 0121 222 9576

Careers email


We have also appointed an external data protection officer (DPO) and their details are as follows:


Evalian Limited

West Lodge

Leylands Business Park

Colden Common


SO21 1TH

United Kingdom



Phone: +44 (0)333 050 0111



Lawful Basis


The lawful basis for our recruitment process is contractual obligation, to help us enter into or take the necessary steps required to enter into employment contracts.


Personal Data Collected


Our job vacancies are advertised on our website via the “Caring Careers” section. Each job application will require applicants to send through our web forms the following personal data:


  • Full name
  • Email address
  • Telephone number
  • Position applied for
  • Cover letter
  • CV information


We may need to process special category personal data (e.g., disability information) as part of the recruitment process, which we have detailed below.


How We Obtain Personal Data


During our recruitment process we may obtain personal data about candidates through various means, which include (but is not limited to):


  • Directly from the candidate
  • Any applicable third-party recruitment agencies
  • DBS check providers
  • Specified referees
  • Data sharing amongst care homes and head office


How Is Personal Data Used?


Personal data processed as part of the recruitment process can include the following activities:


  • To assess your skills, qualifications, and suitability for the role
  • Carry out background and reference checks, where applicable
  • Communicate with you about the recruitment process
  • Keep records related to our hiring processes
  • Comply with legal or regulatory requirements
  • If successful offer suitable candidates’ contracts of employment


If you fail to provide information when requested, which is necessary for us to consider your application (such as evidence of qualifications or work history) we will not be able to process your application successfully.


Special Category Personal Data


As mentioned above we may need to process special category personal data to ensure a fair recruitment process. If a candidate informs us that any adjustments are needed (e.g., wheelchair user or visually impaired) we will be sure to document this and keep it safe and secure, and made available to those who need access to this data. This data will also be held for as long as necessary as part of our data retention guidelines.


Criminal Conviction and Offences Data 


As mentioned on our privacy notice on our website, our residential care homes require background checks on vacancies applied for. We carry out both basic and enhanced checks, but this is dependent on job roles which require interactions with our care home residents. We are legally required to ensure all our staff have had sufficient background checks in line with our safeguarding and care home obligations.


We will only request information on criminal convictions and offences when a job offer has been made and satisfactory references have been obtained.


Applicants who may have a criminal record should not be discouraged from applying from our job roles as they could make significant contributions to our organisation and any offences may not be relevant to a vacancy we advertise.


Where we do process any criminal conviction and offence data, we will ensure the safety and security of this data, so it is not compromised in any way.



Data Sharing 


As mentioned above personal data of job applicants can be shared between the relevant care home and head office. We do this to ensure the recruitment process has been carried out in accordance with our recruitment policies and the appropriate files can be created and maintained. We do not share recruitment data with any third parties.


International Data Transfers


We do not transfer any recruitment data outside the UK to other companies or individuals based in the EEA (European Economic Area) or globally.


Automated Decision-Making and Profiling


We do not conduct any automated decision making and profiling as part of our recruitment process.


Data Security


We have certifications with security frameworks such as Cyber Essentials and Cyber Essentials Plus, and copies of these certificates are available upon request. We also review our certifications annually.


We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorised way, altered, or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.


If we become aware of any loss, misuse, alteration of personal data we will work closely with our IT team, DPO and other parties as necessary to investigate the incident at hand. We have put into place the relevant procedure and policies in place to investigate, mitigate and report (when needed to relevant parties) such instances.


Data Retention  


We retain recruitment data for as long as needed as part of our recruitment process. If you have not been successful, we will typically retain this data for a period of 6 months so we can show and evidence a fair recruitment process and there is no discrimination on any protected characteristics/grounds. After this period has ended all relevant data will be securely destroyed.


When we carry out background checks as mentioned above we only retain the certificate numbers. Background checks are conducted every 3 years and we only retain the certification numbers in each check. You can contact us using our details above should you have any questions or concerns to this.


Successful candidates will have their recruitment data added to their HR file which is maintained and held by our head office.



Data Protection Rights


If you are based in the UK, you have several Rights to how an organisation processes your personal data. The Rights are as follows:


  • Right to be informed
  • Right to access data
  • Right to rectification
  • Right to erasure
  • Right to restrict processing
  • Right to objection
  • Right to portability
  • Right not to subject to automated decision making and profiling


If you would like to exercise any of the above Rights, you can do so by sending us a written request to our email address mentioned below.


Concerns and Complaints


We understand you may have concerns and complaints to this notice and any aspects to how we process personal data. If you would like to contact us directly to talk to us about a concern or to raise a complaint, you can do so by using our contact details above.


You can also submit a complaint directly to the Information Commissioners Office (the ICO), the UK supervisory authority for data protection in the UK, via this link


Review and Updates


We will review this notice and make changes to it from time to time. We recommend that you check this notice to see where changes have been made and to ensure you are able to review updated information at all times.