Candidate Privacy Notice

Candidate Privacy Notice (for website) – HR022

Purpose of this Notice

Impact Futures Group (“we”, “our”, “us”) is the data controller of your personal data. This means we decide how and why your information is use You are seeing this notice because you are applying for work with us (whether as an employee, worker, or contractor). This notice explains:

• What personal data we collect about you
• How and why we use it
• How long we keep it
• Your privacy rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018

Data Protection Principals

We will:

• Use your data lawfully, fairly, and transparently
• Collect it only for the purposes we explain here
• Limit collection to what is relevant and necessary
• Keep it accurate and up to date
• Store it securely
• Keep it only for as long as needed

Information We Collect

Personal data:

• Details you provide in your CV, cover letter, application form, or at interview (name, address, contact details, date of birth, gender, employment history, qualifications)
• Information available on professional social media sites (e.g., LinkedIn)
• Information from referees

Special category data (only where relevant):

• Health/disability information (to make reasonable adjustments) – processed under Article 9(2)(b) UK GDPR (employment obligations)
• Criminal convictions – process processed under Article 10 UK GDPR and Schedule 1, Part 1, DPA 2018 (legal obligations for certain roles)

How we Collect Your Data

We may collect data from:

• You directly
• Your referees
• The Disclosure and Barring Service (DBS
• Publicly available professional resources (e.g. LinkedIn)

How We Use Your Information and Lawful Bases

We do not rely on consent for core recruitment activities. Consent will only be used for keeping your data for longer in a talent pool.

Social Media Screening

We may review publicly available professional social media profiles to verify career history and qualifications. We will not use private social media content or make decisions solely based on social media findings.

Data Sharing

We share your data only with:

• Our current DBS provider
• Our current HR System Provider
• Our current Applicant Tracking System
• Other group companies where necessary

We require these parties to keep your data secure and use it only for agreed purposes.

International Transfers

We do not currently transfer your personal data outside the UK. If this changes, we will ensure appropriate safeguards are in place.

Data Security

We have measures to prevent unauthorised access, loss, or misuse of your personal information. Only staff who need the data for legitimate purposes can access it, and they are bound by confidentiality obligations.

Data Retention

If you are unsuccessful, we will keep your data for 6 months from the date of our decision. This allows us to:

• Show we have not discriminated in the recruitment process
• Defend against potential legal claims

After this period, your data will be securely deleted. If you agree, we may keep your details in a talent pool for a fixed period (we will ask for your explicit consent).

Your Rights

You have the right to:

• Access your data (data subject access request)
• Correct inaccurate data
• Erase your data in certain situations
• Restrict how we process your data
• Object to processing where we rely on legitimate interests
• Request transfer of your data to another party

To exercise your rights please email hr@impactfutures.co.uk

Withdrawal of Consent

We process your data based on consent (e.g., talent pool), you can withdraw that consent at any time by contacting hr@impactfutures.co.uk

Contact and Complaints

Our Data Protection Officer (DPO) can be contacted at info@impactfutures.co.uk. You can also complain to the UK Information Commissioner’s Office (ICO) at www.ico.org.uk.

Document Control

Print Name: Jenni Price

Job Title: HR Director