Privacy policy
BROMLEY Y RECRUITMENT PRIVACY NOTICE
For job applicants, prospective workers, volunteers, trustees, interns and agency candidates
Version 0.6
Last updated: September 2026
PURPOSE OF THIS NOTICE
This notice explains how Bromley Y collects, uses, shares and protects personal information during recruitment and selection. It should be read alongside the vacancy information and any role-specific instructions.
WHO WE ARE AND HOW TO CONTACT US
Bromley Y is the data controller for the personal information described in this notice. This means that we decide how and why your information is used.
• Data Protection Officer: [email protected]
• Human Resources: [email protected]
• Address: Bromley Y, 17 Ethelbert Road, Bromley, BR1 1JA
• Telephone: 020 3770 8848
WHO THIS NOTICE APPLIES TO
This notice applies to people who apply, or are considered, for employment, worker, volunteer, trustee, internship, placement or agency opportunities with Bromley Y.
If you are appointed, relevant recruitment information will become part of your employment or engagement record and will be handled under the applicable staff privacy arrangements and retention schedule.
INFORMATION WE MAY COLLECT
We collect only information that is relevant and proportionate to the recruitment process. Depending on the role and stage reached, this may include:
• Identity and contact details, including your name, address, email address and telephone number.
• Your CV, application form, covering letter, employment and education history, qualifications, professional memberships, skills and experience.
• Interview notes, assessment results, scoring records, correspondence and information about your availability, notice period and salary expectations.
• References and information needed to verify your employment history, qualifications and suitability.
• Proof of identity and your right to work in the UK.
• Information needed for safeguarding and pre-employment checks, including Disclosure and Barring Service information where the role is eligible.
• Health or disability information that you choose to provide, or that is needed to consider reasonable adjustments or occupational health advice.
• Equal opportunities monitoring information, such as age, disability, ethnicity, religion or belief, sex, sexual orientation and gender reassignment status. This information is normally separated from the selection process.
• Information about criminal convictions or offences where it is lawful, necessary and relevant to the role.
• Immigration or sponsorship information where relevant.
• Records relating to recruitment queries, complaints, safeguarding concerns or legal claims.
• Technical information produced when you use our website or an online recruitment platform, such as device, log and security data, as described in the relevant website or platform notice.
Please do not include unnecessary sensitive personal information in your application. Where we need additional information, we will explain why it is required.
WHERE WE OBTAIN YOUR INFORMATION
We usually obtain information directly from you. We may also receive information from:
• Recruitment agencies, job boards or online recruitment platforms through which you apply.
• Referees, previous employers, educational institutions and professional or regulatory bodies.
• The Disclosure and Barring Service, the Home Office or other bodies involved in lawful pre-employment checks.
• Publicly available professional sources, where checking them is relevant, necessary and proportionate.
• Bromley Y colleagues who refer you for a vacancy or take part in the recruitment process.
We will normally seek references and carry out detailed pre-employment checks only at the appropriate stage of the process. We will tell you where a check requires further information or consent.
HOW AND WHY WE USE YOUR INFORMATION
We may use your information to:
• Receive and acknowledge applications and communicate with you.
• Assess your skills, experience and suitability against the requirements of the role.
• Arrange interviews, assessments and reasonable adjustments.
• Verify information, references, identity, qualifications, professional registration and your right to work.
• Carry out lawful safeguarding, DBS and other pre-employment checks.
• Make, manage or withdraw conditional offers and prepare an employment or engagement contract.
• Monitor equality of opportunity and improve the fairness and effectiveness of our recruitment.
• Protect Bromley Y, applicants, service users and others from fraud, security risks or harm.
• Respond to queries, complaints, audits, regulatory requirements and legal claims.
• Invite you to consider other vacancies or retain your details for a talent pool, but only where you have chosen this option.
OUR LAWFUL BASES
Under Article 6 of the UK GDPR, we rely on one or more of the following lawful bases:
STEPS BEFORE A CONTRACT – ARTICLE 6(1)(b)
We use this basis to consider your application, communicate with you, make an offer and take steps at your request before entering into a contract.
LEGAL OBLIGATION – ARTICLE 6(1)(c)
We use this basis to meet legal duties, including right-to-work, equality, employment, safeguarding, tax and regulatory requirements where applicable.
LEGITIMATE INTERESTS – ARTICLE 6(1)(f)
We use this basis to run a fair and effective recruitment process, keep appropriate records, protect our organisation and service users, and establish, exercise or defend legal claims. We balance these interests against your rights.
CONSENT – ARTICLE 6(1)(a)
We use consent for genuinely optional purposes, such as keeping an unsuccessful applicant’s details in a talent pool. You may withdraw your consent at any time without affecting any processing carried out before your consent was withdrawn.
SPECIAL CATEGORY INFORMATION
Where we process health, disability, equality monitoring or other special category information, we also identify a condition under Article 9 of the UK GDPR and the Data Protection Act 2018.
Depending on the circumstances, this may include:
• Employment and social protection law under Article 9(2)(b).
• Substantial public interest under Article 9(2)(g).
• Occupational health or assessment of working capacity under Article 9(2)(h).
• The establishment, exercise or defence of legal claims under Article 9(2)(f).
Where required, we maintain an Appropriate Policy Document.
CRIMINAL OFFENCE INFORMATION
We process criminal conviction and offence information only where this is lawful, necessary and proportionate.
This may include a basic, standard or enhanced DBS check only where the role is eligible. We rely on an Article 6 lawful basis and a relevant condition in Schedule 1 to the Data Protection Act 2018, with appropriate safeguards and an Appropriate Policy Document where required.
A criminal record will not automatically prevent appointment. Information will be considered fairly in relation to the role, safeguarding duties and applicable law.
EQUALITY MONITORING AND REASONABLE ADJUSTMENTS
Bromley Y is committed to fair and inclusive recruitment.
Equality monitoring information is used to understand and improve our recruitment practices and is normally kept separate from shortlisting and selection decisions. We do not discriminate unlawfully because of a protected characteristic.
You can ask for a reasonable adjustment at any stage of the recruitment process. Information about an adjustment will be shared only with people who need it to arrange the process or meet our legal obligations.
Please contact [email protected] if you require a reasonable adjustment or an application in an alternative format.
SHARING YOUR INFORMATION
Access is limited to people who need the information for recruitment or related legal and safeguarding purposes.
We may share relevant information with:
• HR staff, recruiting managers, interview or assessment panel members, and authorised senior leaders or trustees.
• IT, recruitment, testing, payroll, occupational health, legal or other service providers acting under contract and confidentiality obligations.
• Recruitment agencies, referees, previous employers, professional bodies and education providers.
• The Disclosure and Barring Service, the Home Office, regulators, commissioners, law enforcement or safeguarding bodies where lawful and necessary.
• Courts, tribunals, insurers, auditors or professional advisers where needed to comply with the law or manage a claim.
We do not sell applicant information.
We require processors acting on our behalf to use personal information only in accordance with our instructions, keep it secure and comply with data protection law.
INTERNATIONAL TRANSFERS
We do not routinely transfer recruitment information outside the UK. Some suppliers may store or access information in another country.
Before allowing a restricted transfer, we will ensure that a lawful transfer mechanism and appropriate safeguards are in place. These may include UK adequacy regulations or the UK International Data Transfer Agreement or Addendum, together with any required risk assessment.
AUTOMATED DECISION-MAKING
Bromley Y does not currently make recruitment decisions based solely on automated processing that produces legal or similarly significant effects.
If this changes, we will provide clear information about the process, the logic involved, the likely consequences and the available safeguards. These safeguards include the right to obtain human intervention and challenge a decision where the law applies.
HOW LONG WE KEEP RECRUITMENT INFORMATION
We keep recruitment information only for as long as it is needed for the purposes described in this notice, taking account of legal, safeguarding, regulatory and claims requirements.
Our usual approach is:
• Unsuccessful applications and selection records: normally six months after the recruitment process ends, unless a longer period is needed for a complaint, dispute, safeguarding matter or legal claim.
• Talent pool records: for the period stated when you opt in, normally up to 12 months, unless you withdraw your consent sooner.
• Successful applicant records: relevant information will be transferred to the staff or engagement record and kept under the applicable retention schedule.
• DBS certificate information: certificates are not normally copied or retained. Any permitted record of the check will be kept only for as long as it is lawful and necessary.
When information is no longer required, it will be securely deleted, destroyed or anonymised.
You may request further information about the relevant retention period by contacting the Data Protection Officer.
HOW WE PROTECT YOUR INFORMATION
We use appropriate technical and organisational measures to protect recruitment information.
These include:
• Access controls.
• Secure systems.
• Staff training.
• Confidentiality requirements.
• Supplier due diligence.
• Data minimisation.
• Secure disposal.
No system is completely risk-free, but we regularly review our measures and respond to suspected personal data breaches in line with legal requirements.
YOUR DATA PROTECTION RIGHTS
Depending on the circumstances, you may have the right to:
• Be informed about how your personal information is used.
• Request access to your personal information.
• Ask us to correct inaccurate or incomplete information.
• Ask us to erase information where there is no lawful reason to keep it.
• Ask us to restrict how your information is used.
• Object to processing based on legitimate interests.
• Receive certain information in a portable format where the right applies.
• Withdraw consent for optional processing at any time.
• Raise concerns about solely automated decisions where the law applies.
These rights are not absolute and may not apply in every case. We may need to confirm your identity before responding.
To exercise a right, contact [email protected]. We will respond without undue delay and normally within one month, subject to any lawful extension.
QUESTIONS AND COMPLAINTS
Please contact our Data Protection Officer first if you have a question or concern about how we use your information. We will consider and respond to your concern in accordance with data protection law.
You also have the right to complain to the Information Commissioner’s Office:
• Website: https://ico.org.uk/make-a-complaint/
• Telephone: 0303 123 1113
The ICO recommends raising concerns promptly and normally within three months of your last meaningful contact with the organisation.
RELATED LAW AND GUIDANCE
This notice has been prepared with reference to:
• The UK General Data Protection Regulation.
• The Data Protection Act 2018, as amended, including by the Data (Use and Access) Act 2025.
• The Equality Act 2010.
• UK right-to-work requirements.
• Information Commissioner’s Office guidance on recruitment and selection.
• Acas guidance on fair recruitment and reasonable adjustments.
This notice should be reviewed when Bromley Y changes its recruitment systems or practices and at appropriate intervals.