Privacy Policy for Sanctuary Graduates
1. Who we are
Sanctuary Search Ltd, trading as SanctuaryGraduates (“Sanctuary Graduates”, “we”, “us” or “our”), provides early careersrecruitment, attraction, screening, assessment and candidate managementservices.
For data protection purposes, SanctuaryGraduates may act as a controller of personal data where we decide why and howpersonal data is processed. In some client engagements, our role may differdepending on the contractual arrangements and the processing activity.
Sanctuary Search Ltd is registered inEngland and Wales under company number 08013693. Our registered office is TheUnion Building, 51-59 Rose Lane, Norwich, NR1 1BY.
You can contact us about data protectionmatters at: andrew.neil@sanctuarygraduates.co.uk.
2. Who this notice applies to
This notice applies to individuals whosepersonal data we process in connection with our recruitment and early careersservices, including candidates, applicants, students, graduates, apprentices,event attendees, individuals who register an interest in opportunities andpeople who contact us about our services.
3. Personal data we may collect
Depending on the recruitment process orservice, we may collect and process:
• identity andcontact information, including name, email address, telephone number andaddress;
• applicationand profile information, including CV, education, qualifications, employmenthistory, university, course and graduation year;
• eligibilityinformation, including right-to-work or work authorisation information whererelevant;
• screening,interview and assessment information, including recruiter notes, scores,interview responses, video or audio recordings and assessment outcomes;
• communicationsand service records, including emails, telephone notes, feedback and candidatesupport records;
• technical andusage information generated when you use our websites or systems;
• informationrelating to reasonable adjustments or accessibility requirements; and
• diversity andequal opportunities information, where you choose to provide it and where wehave an appropriate lawful basis and UK GDPR condition to process it.
We aim to collect only the personal datareasonably necessary for the relevant recruitment or service-delivery purpose.
4. How we obtain your personal data
We may obtain personal data:
• directly fromyou when you apply, register, complete an assessment, attend an event orcontact us;
• from employersor clients where they ask us to support a recruitment process;
• fromrecruitment platforms, job boards, university or careers networks and otherattraction channels where appropriate;
• from refereesor other third parties where relevant and lawful; and
• through ourwebsites, systems and recruitment technology.
5. How we use your personal data
We may use personal data to:
• administerapplications and candidate registrations;
• assesseligibility and suitability for opportunities;
• conductscreening, interviews, video interviews, assessments and shortlisting;
• communicatewith you about applications, interviews, events and recruitment processes;
• providereasonable adjustments and candidate support;
• share relevantcandidate information with an employer or client where appropriate for arecruitment process;
• consider youfor other suitable opportunities where this is consistent with the informationprovided to you and an appropriate lawful basis;
• managecomplaints, queries, data subject rights requests and safeguarding or welfareconcerns;
• maintainsecurity, prevent misuse and investigate incidents;
• producemanagement information, audit information and diversity reporting, usually inaggregated or anonymised form where practical;
• comply withlegal, regulatory, contractual and professional obligations; and
• improve ourrecruitment services and processes.
6. Lawful bases for processing
The lawful basis we rely on depends on theparticular processing activity. It may include:
• legitimateinterests, where processing is necessary for the proper administration anddelivery of our recruitment services and those interests are not overridden byyour rights;
• steps taken atyour request before entering into a contract, or performance of a contract;
• compliancewith a legal obligation; and
• consent, whereconsent is appropriate.
Where we process special category data,such as diversity, health or reasonable-adjustment information, we will alsoidentify an appropriate condition under UK data protection law.
Where we relyon consent, you may withdraw it at any time, although this will not affectprocessing already carried out lawfully before withdrawal.
7. Recruitment technology, video interviews and AI
We may use approved recruitment, screeningand assessment technologies to support recruitment delivery. This can includeapplicant tracking systems, video interview platforms and assessment tools.
Where artificial intelligence, profiling orautomated tools are used to assist with screening or assessment, we will assessthe privacy and fairness risks associated with that processing and applyappropriate human oversight and controls. We do not intend to make solelyautomated decisions that produce legal or similarly significant effects oncandidates unless this is lawful, appropriate and clearly explained to theindividual.
Where required, a Data Protection ImpactAssessment will be considered or completed before higher-risk processingbegins.
8. Sharing personal data
We may share personal data with:
• employers andclients involved in the recruitment process;
• authorisedSanctuary Graduates employees, workers and contractors who need the informationto perform their role;
• approvedtechnology, recruitment, screening, assessment, communications, hosting orprofessional-service providers that process data on our behalf;
• regulators,law-enforcement bodies, courts, professional advisers, insurers or otherparties where disclosure is required or permitted by law; and
• prospectivepurchasers, investors or professional advisers in connection with a corporatetransaction, subject to appropriate confidentiality and data-protectionsafeguards.
We limit disclosure to what is reasonablynecessary for the relevant purpose and apply appropriate contractual andsecurity controls to suppliers and processors.
9. International transfers
Some approved suppliers or serviceproviders may process or permit access to personal data from locations outsidethe United Kingdom.
Where personal data is transferredinternationally, we will ensure that an appropriate transfer mechanism is inplace where required. This may include a UK adequacy regulation, the UKInternational Data Transfer Agreement, the UK Addendum to the EU StandardContractual Clauses, or another lawful safeguard. Where appropriate, we willalso consider transfer risk and supplementary security measures.
10. Data security
We use appropriate technical andorganisational measures to protect personal data against accidental or unlawfulloss, alteration, disclosure, destruction or unauthorised access.
Our controls include use of approvedbusiness systems, role-based access, secure cloud storage, controlled sharing,password and authentication controls, and incident-reporting procedures. Coreproject documents are held in approved Microsoft 365 environments, includingOneDrive and SharePoint, and approved recruitment or assessment systems areused where appropriate.
11. Retention
We keep personal data only for as long asit is required for the purpose for which it was collected, taking account oflegal obligations, contractual requirements, client instructions, legitimateoperational need and the possibility of complaints or legal claims.
At the end of the relevant retentionperiod, personal data will be securely deleted, anonymised, returned orarchived as appropriate. Retention periods may therefore vary depending on thetype of information, the relevant recruitment campaign and applicablecontractual or legal requirements.
12. Your rights
Depending on the circumstances, you mayhave the right to:
• request accessto your personal data;
• requestcorrection of inaccurate or incomplete personal data;
• requestdeletion of your personal data;
• requestrestriction of processing;
• object toprocessing based on legitimate interests or to direct marketing;
• requestportability of certain personal data;
• withdrawconsent where processing is based on consent; and
• raise aconcern about how your personal data has been handled.
These rights are subject to legalconditions and exemptions. To exercise a right, contact us using the details insection 1.
13. Complaints
If you have a concern about how we use yourpersonal data, please contact us first so that we can investigate and respond.
You also have the right to complain to theInformation Commissioner’s Office (ICO), the UK supervisory authority for dataprotection.
14. Cookies and website information
Where our website uses cookies or similartechnologies, information about their use and the choices available to you willbe provided through the relevant website cookie notice or consent controls.
15. Changes to this notice
We may update this notice from time to timeto reflect changes in law, our services, systems, suppliers or processingactivities. The latest version will be made available through our website orother appropriate candidate-facing channels.
