Candidate Privacy Notice

1. Introduction

We are delighted that you may be considering working in our care home Group, and we are committed to protecting the privacy and security of your personal data, as well as transparency around how our Group takes care of your personal data. This Candidate Privacy Notice outlines how the Care Concern Group collects, processes, and uses the personal information you provide to us during the recruitment and application process.

At the application stage, CCG Opco Limited, Priory CC112 Limited and Alor Healthcare Limited, together trading as the Care Concern Group (‘Company’), and the care home entity to which you are or have applied, are the joint ‘controllers’ of personal data and gather and use certain data about you. The joint controllers have agreed their respective responsibilities in relation to compliance with data protection law. Day-today responsibility for managing recruitment activities will normally sit with the care home to which you have applied, acting with support from the Care Concern Group Recruitment team where appropriate. You may exercise your data protection rights by contacting either the relevant care home or the Group Data Protection Officer using the contact details set out in this Notice.

Where you are applying to an existing care home, the care home name will be stated in the role advertisement, and more details about them are available in the privacy notice held on the care home’s website.

Where you are applying to a new care home that is being set up, the care home company once set up will also be a data controller and information on that will be shared with you during the recruitment process.

The joint controllers process candidate information for shared recruitment, workforce planning, compliance and employment administration purposes across the Care Concern Group.

Please contact our Group Data Protection Officer at the address below if you would like any further information.

In addition, your data may also be shared with and used by our parent companies, affiliated entities and group companies that are relevant for the care home to which you have applied and so, in this notice, references to ‘we’ or ‘us’ mean the Company and our group companies.

2. What Information We Collect

We collect the following types of personal information about you when you apply for a position with us:

• Contact Information: Full name, email address, phone number, physical address.
• Resume/CV Information: Employment history, educational background, skills, qualifications, certifications, whether or not you have a disability for which we need to make reasonable adjustments during the recruitment process.
• Application Data: Cover letter, job preferences, salary expectations, desired start date, entitlement to work in the UK.
• Identifiers: Government-issued IDs (passport, driver’s license, national insurance number), Social Security number (where applicable), professional or regulatory body checks eg Nursing Midwifery Council pin check if applicable, Scottish Social Security and/or Protecting Vulnerable Groups scheme checks if applicable.
• Reference Information: Names and contact details of referees, previous employers.
• Assessment Results: Results from interviews, tests, or assessments (if applicable).
• Background Check Information: If applicable, information related to criminal background checks, credit checks, or drug testing.
• Equal opportunities monitoring information: optional form including information about your ethnic origin, sexual orientation, health and religion or belief.

We may collect this data from you, your referees (details of whom you will have provided), a recruiter, your education provider, the relevant professional body, the Disclosure and Barring Service (DBS) or other background or record check providers, and the Home Office. Data will be stored in a range of different places, including on your application record, applicant tracking systems, in your recruitment file and on HR management systems and on other IT systems (including email), and if applicable, on VISA management systems.

3. How We Use Your Information

We use your personal information for the following purposes:

• Recruitment Process: To evaluate your qualifications and suitability for employment.
• Communication: To contact you regarding your application and the recruitment process.
• Verification: To verify the accuracy of the information provided, including contacting references.
• Legal Requirements: To comply with legal obligations, regulations, and internal policies, to deal with any claims that may arise from the recruitment process.
• Legitimate interests: or those of a relevant third party (such as a benefits provider), but only if these are not overridden by your interests, rights or freedoms. Our legitimate interests include recruiting suitable employees, managing recruitment processes efficiently, protecting residents and colleagues, maintaining employment records, ensuring workforce planning and defending legal claims.
• Contract: to take steps to enter into a contract with you, if you are successful in your application.
• Talent Pool: With your consent, we may retain your information for future job opportunities.

We seek to ensure that our data collection and processing is always proportionate. We will notify you of any changes to data we collect or to the purposes for which we collect and process it.

The table set out in Part A of the schedule below summarises the data we collect and hold up to and including the shortlisting stage of the recruitment process, how and why we do so, how we use it and with whom it may be shared.

The table in Part B of the schedule below summarises the additional data we collect before making a final decision to recruit, ie before making an offer of employment unconditional, how and why we do so, how we use it and with whom it may be shared.

We seek to ensure that our data collection and processing is always proportionate. We will notify you of any changes to data we collect or to the purposes for which we collect and process it.

4. How We Share Your Information

Your personal data may be shared with:

• Internal Team: Hiring managers, recruitment and/or HR personnel and interview panel members within our Group.
• Recruitment Service Providers: Recruitment agencies, applicant tracking system providers, job board providers and recruitment software providers who assist us in managing vacancies, processing applications and administering the recruitment process.
• Third-Party Service Providers and Professional Advisers: Background check providers, occupational health providers, legal advisers, insurers and other service providers and advisers involved in the recruitment process.
• Group Companies: The group companies identified in this Notice where necessary for shared recruitment, workforce planning, compliance or employment administration purposes.
• Legal Authorities and Regulators: If required to comply with legal obligations or respond to lawful requests.

5. Data Retention

We retain your personal information for as long as necessary to process your application and comply with applicable legal and regulatory requirements.

How long we keep your data will depend on whether your application is successful and you become employed by us, the nature of the data concerned and the purposes for which it is processed.

We will keep recruitment data (including interview notes) for no longer than is reasonable, taking into account the limitation periods for potential claims such as race or sex discrimination (as extended to take account of early conciliation), after which they will be destroyed.

If your application is not successful we will keep your data on file for 12 months after the recruitment process. If you agree, we will keep your recruitment data for up to a further 6 months after that in case any further relevant opportunities arise. If you change your mind, your consent can be withdrawn at any time by contacting our Data Protection Officer via the details given below. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.

If your application is successful: -

1. we will keep the recruitment data (and if applicable, VISA data) that is necessary in relation to your employment; and
2. your information will be transferred to your employee file and will be subject to our Employee Data Privacy Notice.
3. Personal data relating to VISA processes or for candidates under immigration control, will be kept for 1 year beyond end of employment, in line with statutory requirements and our Employee Data Privacy Notice.

6. Your Rights

You may have certain rights concerning your personal information under applicable data protection laws, including:

• Access - request access to and a copy of the personal information that we hold about you.
• Rectification - request that we correct any inaccurate or incomplete personal information that we hold about you.
• Erasure - request that we delete your personal information where there is no lawful reason for us to continue processing it.
• Restriction - request that we suspend the processing of your personal information in certain circumstances, for example whilst a complaint about its accuracy is being investigated.
• Object - object to the processing of your personal information where we are relying on legitimate interests as our lawful basis for processing.
• Data Portability - request the transfer of personal information that you have provided to us to you or another organisation, where processing is based on your consent or on a contract and is carried out by automated means.
• Withdraw Consent - where we rely on your consent, such as where you have agreed to remain in our talent pool for future opportunities, you may withdraw your consent at any time. Withdrawal of consent will not affect the lawfulness of any processing carried out before consent was withdrawn.
• Automated Decision-Making - you have the right not to be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you. While we may use application screening questions as part of our recruitment process, you may request a human review of any decision taken solely by automated means by contacting us using the details below.
• To exercise any of these rights, please contact the relevant care home manager or our Group Data Protection Officer at dataprotection@careconcerngroup.com.
• You also have the right to lodge a complaint with the Information Commissioner's Office ("ICO"), the UK regulator for data protection matters. Further information is available at www.ico.org.uk.

Our role advertisements may contain specific screening questions, dependent on the role requirements, and we may use these to filter applications, for example where clinical certifications or qualifications are required. If your application has been declined at this preliminary screening stage, you can request a human review of the decision by emailing dataprotection@careconcerngroup.com with full details of the role applied for.

7. Data Security

We have implemented appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, or misuse, including:-

• Access controls
• Role-based permissions
• Encryption
• Audit logging
• Secure document storage

We limit access to your personal data to those who have a genuine business need to know it. Those processing your data will do so only in an authorised manner.

We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

8. International Transfers

Your personal data may be transferred outside the UK, including to the Philippines and / or USA, by ourselves or one of our third-party service providers or suppliers. Where this happens, we ensure that appropriate safeguards and additional contractual, technical and organisational controls are in place to protect your personal data and to ensure that it is handled in accordance with applicable data protection law. Transfers are protected through the use of the UK International Data Transfer Agreement (IDTA), the UK Addendum to the European Commission Standard Contractual Clauses, adequacy regulations, or other lawful transfer mechanisms.

9. Changes to This Policy

We may update this Notice from time to time to reflect changes in our practices or applicable laws. Any changes will be posted on our website with the updated effective date.

10. Contact Us / Complaints process

If you have any questions, concerns or complaints about this Candidate Privacy Notice or how we have handled your personal data, please raise them first with:-

1. the applicable care home manager if you are applying / have applied to a particular care home; or
2. if you are applying / have applied to a group position, please contact our Group Data Protection Officer via the email address or postal address below.

Your complaint will be acknowledged within 5 working days, and we will let you know who is investigating your complaint. You will be given the chance to talk to the person carrying out the investigation in private (and with the support of a carer or advocacy if required). We will look to conclude the complaint within 20 working days and keep you up to date by letter/email every seven to ten working days.

You will receive a response at the end of the investigation and within this we will note who can contact if you are not happy with the outcome. If your complaint relates to a particular care home, the person will usually be our Group Data Protection Officer, at the contact details below.

Where a complaint is made on behalf of another person, we may ask for proof of identity and authority to act.

Following our investigation, we may:

• explain our findings;
• apologise where appropriate;
• correct, restrict or delete personal data where required and if applicable;
• improve our processes, guidance or staff training; or
• take any other appropriate remedial action.

We hope that our Group Data Protection Officer can resolve any query or concern you raise, and they can be contacted via email at dataprotection@careconcerngroup.com or via post:

Group Data Protection Officer, Care Concern Group, Link Spaces, Botanica, Ditton Park, Riding Court Road, Slough, SL3 9LL

If our Group Data Protection Officer is not able to resolve your concern or complaint, please contact the Information Commissioner at https://ico.org.uk/concerns/ or telephone: 0303 123 1113 for further information about your rights and how to make a formal complaint.

THE SCHEDULE

Part A

Up to and including the shortlisting stage

If your application is unsuccessful at this stage, we will keep your data for the purpose of establishing, exercising and/or defending any legal claims, in accordance with our legitimate interests.

Part B

Before making a final decision to recruit

You are required (by law or in order to enter into your contract of employment) to provide the categories of data marked ‘☐’ above to us to enable us to verify your right to work and suitability for the position. Failure to provide certain information may prevent us from assessing your suitability for employment or completing legally required checks.

If your application is unsuccessful at this stage, we will keep your data as set out in this Notice, for the purpose of establishing, exercising and/or defending any legal claims, in accordance with our legitimate interests.

Further details on how we handle special category data and data relating to criminal convictions and offences is available on request from our Group Data Protection Officer.

Copyright © 2026 Care Concern Group