Candidate Privacy Policy

Candidate Privacy Notice

Head of AI

This Candidate Privacy Notice explains how Head of AI (“we”, “us”, “our”) collects, uses and protects personal data relating to individuals who apply for a role with us, whether through our website, LinkedIn, a recruitment agency, or any other channel.

We are the data controller for the personal data we process about you in connection with your application. We are committed to processing your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

Head of AI

71–75 Shelton Street, London, WC2H 9JQ, United Kingdom

For any questions about this notice or how we handle your personal data, please contact us at: [email protected]

2. What personal data we collect

We collect and process the following categories of personal data during the recruitment process, where provided by you in applications:

  • Identity and contact details – name, email address, telephone number, postal address.
  • Application materials – CV/résumé, cover letter, portfolio, work samples, and any information you include in your application.
  • Professional information – employment history, education, qualifications, skills, professional memberships, references, and LinkedIn profile information.
  • Right to work information – documents and details we are legally required to verify before making an offer.
  • Interview records – notes, assessments, and scores from interviews, tasks or assessments you complete.
  • Communications – correspondence between you and us during the recruitment process.
  • Diversity information (optional) – where you voluntarily provide it, for equal opportunities monitoring only.

3. How we collect your personal data

We collect personal data about you from the following sources:

  • Directly from you – when you submit an application, complete a form, send us correspondence, attend an interview, or otherwise interact with us during the recruitment process.
  • Third-party platforms – such as LinkedIn, job boards, or recruitment agencies you have engaged with.
  • References – individuals you nominate as referees.
  • Publicly available sources – such as your public LinkedIn profile or professional website, where relevant to the role.

4. Our lawful basis for processing

Under UK GDPR, we rely on the following lawful bases to process your personal data:

  • Legitimate interests (Article 6(1)(f)) – it is in our legitimate interests to review applications, assess candidates, communicate with applicants, and maintain records of the recruitment process. We have balanced these interests against your rights and freedoms.
  • Steps prior to entering a contract (Article 6(1)(b)) – to take steps at your request before entering into an employment contract, such as progressing your application through interview stages and making an offer.
  • Legal obligation (Article 6(1)(c)) – to comply with obligations such as right-to-work checks.
  • Consent (Article 6(1)(a)) – where you voluntarily provide optional information (such as diversity data) or agree to us keeping your details on file for future opportunities. You can withdraw consent at any time.

5. Who we share your personal data with

We keep your personal data confidential and only share it where necessary. This may include:

  • Members of our hiring team, HR personnel and relevant managers involved in the recruitment decision.
  • Third-party service providers who support our recruitment process (for example, applicant tracking systems, background check providers, and assessment platforms), who act as our processors under appropriate contracts.
  • Referees you have nominated.
  • Regulatory, law enforcement or government bodies, where we are legally required to do so.

We do not sell your personal data, and we do not share it for marketing purposes.

6. International transfers

Where we transfer your personal data outside the United Kingdom, we ensure an appropriate level of protection is in place, such as a UK adequacy decision, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.

7. How long we keep your personal data

If your application is unsuccessful, we will retain your personal data for 12 months after the conclusion of the recruitment process, so that we can respond to any queries or complaints, defend legal claims, and consider you for other suitable roles (where you have agreed to this).

If you are successful, your personal data will transfer to your employee record and be retained in accordance with our Employee Privacy Notice.

At the end of the retention period, we will securely delete or anonymise your personal data.

8. Your rights

Under UK GDPR, you have the following rights in relation to your personal data:

  • Right of access – to request a copy of the personal data we hold about you.
  • Right to rectification – to have inaccurate or incomplete data corrected.
  • Right to erasure – to have your personal data deleted in certain circumstances.
  • Right to restrict processing – to ask us to limit how we use your data in certain circumstances.
  • Right to object – to object to processing based on our legitimate interests.
  • Right to data portability – to receive your data in a structured, machine-readable format.
  • Right to withdraw consent – where we rely on consent, you can withdraw it at any time.

To exercise any of these rights, please contact us at [insert contact email]. We will respond within one month of receiving your request.

9. How to complain

If you are unhappy with how we have handled your personal data, we encourage you to raise the matter with us first so we can try to resolve it.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s data protection regulator:

  • Website: ico.org.uk
  • Helpline: 0303 123 1113
  • Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

10. Automated decision-making

We do not make decisions about candidates based solely on automated processing that produce legal or similarly significant effects. Where any automated tools are used to support the recruitment process, a human will always be involved in the final decision.

11. Changes to this notice

We may update this Candidate Privacy Notice from time to time. The latest version will always be available on our website.

Last updated: January 2026