Skip to content

Privacy Notice for Trainee Recruitment

Data Controller: Ward Hadaway, People department (

Data Protection Queries:

The Firm collects and processes personal data relating to candidates who apply for a role with Ward Hadaway. The Firm is committed to being transparent about how it collects and uses that data and to meeting its data protection obligations.

What information does the Firm collect?

The Firm collects and processes a range of information about you as part of our standard recruitment process. This includes:

  • Your title and full name(s), address and contact details, including email address and telephone number;
  • The details contained within your application form e.g. your qualifications, skills, experience, work
  • History and responses to our set long-answer questions;
  • Notes from the graduate recruitment team in relation to your application;
  • Information about the roles (including intake and office location) you have applied for with the firm;
  • Information about the stage you have reached in the recruitment process for each position applied for;
  • Information relating to any testing you undertake as part of the recruitment process;
  • Interview notes;
  • Feedback for any assessed activities you take part in as part of the recruitment process.

How does the Firm collect information?

The Firm collects this information via our online recruitment system (All Hires), from correspondence with you; or through interviews, meetings or other assessments.

In some cases, the Firm collects personal data about you from third parties, such as recruitment agencies or references from previous employers.

How does the Firm store data?

Data is stored in a range of different places, including on our online recruitment system relating to the recruitment for a particular position and in other IT systems (including the Firm’s email and document management systems).

Why does the Firm process personal data?

The Firm needs to process data to contact you as part of a recruitment process and to help assess your suitability for a position. We use the information held by us as follows:

  • To provide a service to you as part of the recruitment process;
  • To maintain our business relationship whilst you are a user of our recruitment website;
  • To review your application form against the requirements of the position you have applied for and in the shortlisting process;
  • To review your application for any other suitable job vacancies at the firm either at the time of applying or within the data retention period;
  • To answer your enquiries.

Where the Firm relies on legitimate interests as a reason for processing data, it has considered whether or not those interests are overridden by the rights and freedoms of candidates and has concluded that they are not.

Where the Firm processes other special categories of personal data, such as information about ethnic origin, sexual orientation, health or religion or belief, this is done for the purposes of equal opportunities monitoring. Data that the Firm uses for these purposes is anonymised or is collected with the express consent of employees, which can be withdrawn at any time. Employees are entirely free to decide whether or not to provide such data and there are no consequences of failing to do so.

On rare occasions the Firm may also use your data to protect your interests (or someone else’s interests) or where it is needed in the public interest (or for official purposes). Such occasions may include contacting next of kin in case of emergency, sharing information with emergency services if legally required to do so or for the safeguarding of members of the Firm.

Who has access to data?

Your information will be shared internally, including with members of the people and recruitment team, the hiring manager and managers and employees in the business area in which you are applying to.

The Firm may also share your data with third parties in the context of a sale of some or all of its business. In those circumstances the data will be subject to confidentiality arrangements.

The Firm also engage with third parties as part of the recruitment process. These third parties have their own privacy statements which you will need to agree to where necessary in order for us to continue considering your application as part of the recruitment process:

Who? What? Why?
All Hires Recruitment System (with self-service functionality) To maintain accurate records and contact details for the purposes of undertaking the recruitment process.
Get Feedback Online Testing System (with self-service functionality) To maintain accurate records of testing results related to the recruitment process.
Cascade People / Recruitment / Payroll Management System (with self-service functionality) To maintain accurate records and contact details for the purposes of undertaking the recruitment process.

The Firm will not transfer your data to countries outside the European Economic Area.

How does the Firm protect data?

The Firm takes information security and data privacy extremely seriously and we have implemented a risk based approach to Information Security to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by its employees in the performance of their duties.

Our information security management system (ISMS) conforms to the internationally recognised ISO/IEC27001:2013 Information Security standard which we successfully gained certification in 2015 and re-certified again in April 2018. In addition to this we have also implemented a number of associated Cyber security controls and processes that have allowed us to successfully gain Cyber Essentials Plus certification.

Where the Firm engages third parties to process personal data on its behalf, they do so on the basis of written instructions, are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of data.

For how long does the Firm keep data?

Data Retention Period
Pre-Employment Data
In progress application 6 months from last update
CV and covering letter or online application form – successful application 24 months from submission of application
CV and covering letter or online application form – unsuccessful application 12 months from submission of application
Personal information: Title, names, address, contact details, date of birth, gender – successful application Duration of employment
Interview notes and feedback – successful application 24 months from submission of application
Interview notes and feedback – unsuccessful application 12 months from submission of application
Other recruitment tasks/exercises – successful application 24 months from submission of application
Other recruitment tasks/exercises – unsuccessful application 12 months from submission of application

Your rights

As a data subject, you have a number of rights. You can:

  • request access and obtain a copy of your personal data;
  • require the Firm to change incorrect or incomplete data;
  • require the Firm to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing;
  • object to the processing of your data where the Firm is relying on its legitimate interests as the legal ground for processing; and
  • ask the Firm to stop processing data for a period if data is inaccurate or there is a dispute about whether or not your interests override the Firm’s legitimate grounds for processing data.

If you would like to exercise any of these rights, please contact

If you believe that the Firm has not complied with your data protection rights, you can complain to the Information Commissioner. They can be contacted at:

Information Commissioner’s Office
Wycliffe House
Water Lane

Telephone: 0303 123 1113 (local rate) or 01625 545 745 (national rate).

Website: which sets out email addresses and an email form.

Automated decision-making

Recruitment decisions are not based solely on automated decision-making.

Changes to this privacy notice

We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.

If you have any questions about this privacy notice, please contact the Ward Hadaway People tea.