Recruitment Privacy Notice

Last updated: 24 August 2026

Introduction

As part of our application and recruitment process, Shoptimised collects, processes and stores personal data about you. Shoptimised is a controller in relation to personal data.

This Privacy Notice helps you understand what personal data we collect when you apply for a permanent or fixed term contract position at the Company, why we collect it, what we do with it and the choices you have, including how to access and update your information.

We process your personal data for a range of purposes relating to the recruitment process and this may include your application, assessment, pre-employment screening checks and your right to work in the UK.

This Privacy Notice only applies to the personal data of job applicants and potential candidates for employment. It does not apply to our employees, contractors or clients, or other personal data that Shoptimised collects for other purposes. We may update this notice at any time.

For the purposes of this Privacy Notice, "personal data" means information that identifies applicants and potential candidates for employment with us. We collect this personal data directly from you or through our website or job advertisements. We may sometimes be required to collect additional information from third parties (such as your named referees) or other publicly available sources (such as LinkedIn).

Data protection principles

We will comply with data protection law, which says that the personal data we process about you must be:

1. Used lawfully, fairly and in a transparent way.
2. Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.
3. Relevant to the purposes we have told you about and limited only to those purposes.
4. Accurate and kept up to date.
5. Kept only as long as necessary for the purposes we have told you about.
6. Kept securely.

What personal data do we collect?

In connection with your application, we will collect, store, and use the following categories of personal data about you:

1. Employment history/job data (previous employers, positions, dates, etc).
2. Compensation (basic salary, benefits, bonuses, etc).
3. Education including professional qualifications and skills.
4. Employer feedback / references to include regulated references where necessary.
5. Results of pre-employment screening checks (criminal records checks, right to work information including passport, driving licence, National Insurance numbers, visas).
6. Data we collect during the application process and interview.

If you fail to provide personal data when requested, which is necessary for us to consider your application (such as evidence of qualifications or work history), we will not be able to take your application further.

Special categories of personal data

Special categories of personal data are personal data which the UK GDPR says is more sensitive, and so needs more protection. Special categories of data include ethnicity, health, trade union membership, philosophical beliefs, sexual orientation and biometric data.

We may collect, store and use the following special categories of data about you:

1. Race/ethnicity, disability and gender where we are required to for government reporting. We also collect data for equal opportunity monitoring purposes, to allow us to better understand the diversity characteristics of our applicants and promote equality of opportunity and treatment.
2. Health or disability information to consider whether we need to provide appropriate adjustments during the recruitment process.

We may also use your sensitive personal data in the following ways:

1. To make sure you are eligible to work in the UK.
2. In order to meet our legal obligations or exercise specific rights in the field of employment law.

We have in place an appropriate policy document and safeguards which we are required by law to maintain when processing such data.

Lawful basis for processing personal data

We need certain personal data mainly to let us assess your suitability for a particular position and to allow us to comply with legal obligations. We only process your personal data as necessary for the purposes of progressing your application or as required by law.

Our legal basis for the processing of personal data is our legitimate business interests, described in more detail below, although we will also rely on contract, legal obligation and consent for specific uses of data. Our legitimate interests in collecting and retaining your personal data are as follows:

1. Assess your skills, qualifications, and suitability for the position.
2. Carry out background and reference checks, where applicable.
3. Communicate with you about the recruitment process.
4. Comply with legal or regulatory requirements.
5. Decide whether to enter into a contract of employment with you and, if so, on what terms and conditions.

It is in our legitimate interests to decide whether to appoint you to a particular position since it would be beneficial to our business to appoint someone in that role.

Having received your CV or application, and the results of any assessment, we then process that information to decide whether you meet the basic requirements to be shortlisted for the position. If you do, we will decide whether your application is strong enough to invite you for an interview. If we decide to call you for an interview, we will use the information you provide to us at the interview to decide whether to offer you the position. If we decide to offer you the position, we will then take up references and carry out our employment screening checks before confirming your appointment.

Do we need your consent?

We do not need your consent if we use your personal data for the purposes set out above. In limited circumstances, we may approach you for your written consent to let us process certain particularly sensitive data. If we do so, we will provide you with full details of the information that we would like and the reason we need it, so that you can make an informed decision on whether you wish to consent.

Automated decision-making

You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making.

Who we share your personal data with

We will only share your personal data with the following third parties for the purposes of processing your application:

1. Third party vendors who help us to manage and maintain our IT infrastructure (such as our cloud storage provider and data centre hosts).
2. Any other party deemed necessary for the purposes stated within this notice.

All our third-party providers and other entities in the group are required to take appropriate security measures to protect your personal data in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.

Keeping your information accurate and up-to-date

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during the application process.

Data retention

We will keep your personal data for as long as you are an applicant or an employee. If you are given and accept an offer of employment by Shoptimised, personal data collected during your pre-employment period will become part of your personnel records, to be retained throughout your tenure and for a period after your employment with Shoptimised (specific periods vary depending on the nature of the information).

If your application is unsuccessful, Shoptimised will retain your data for up to 6 months and use personal data collected during the recruitment process in order to:

1. To respond to any questions or complaints.
2. To show that we have not discriminated against applicants on prohibited grounds.
3. To show that we have conducted the recruitment exercise in a fair and transparent way.
4. To maintain records according to rules that applies to us.
5. To establish, bring or defend legal claims.
6. Consider you for other suitable positions.

After this period, we will securely destroy your personal data. We may keep your data for longer than 6 months if we cannot delete it for legal or regulatory reasons. If we do, we will make sure that your privacy is protected and only use it for those purposes. We do not retain personal data in an identifiable format for longer than is necessary.

Data security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need-to-know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

Your rights

Under certain circumstances, by law you have the right to:

1. Request access to your personal data (commonly known as making a data subject access request). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
2. Request rectification of the personal data that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
3. Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have exercised your right to object to processing (see below).
4. Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal data for direct marketing purposes.
5. Request the restriction of processing of your personal data. This enables you to ask us to suspend the processing of personal data about you, for example if you want us to establish its accuracy or the reason for processing it.
6. Request the transfer of your personal data to another party.

Please note that we may be required by law to retain certain information. Before we are able to provide you with any personal data or correct any inaccuracies, we may ask you provide other details to help us respond to your request.

You will not have to pay a fee to access your personal information (or to exercise any of the other rights); however, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in these circumstances.

If you would like to exercise any of these rights, please contact us at data@shoptimised.com. Please note, we may ask you to provide one proof of identity as part of your request.

Questions or complaints

If you have any questions or concerns about this privacy notice or how we handle your personal data, please contact our data protection officer who has been appointed to oversee compliance with this privacy notice and whose contact details are data@shoptimised.com.

You have the right to complain to the Information Commissioner's Office (ICO) if you are concerned about the way we have processed your personal data. Please visit the ICO's website for further details at ico.org.uk/make-a-complaint/data-protection-complaints.