Privacy Notice for Candidates

Privacy Notice for Candidates

This privacy notice describes how we collect and use your personal data during our recruitment process.

It applies to internal and external candidates who apply to work for any company within our Group, whether directly or via a recruitment agency.

This notice does not form part of any contract of employment or other contract to provide services.

This privacy notice was last updated in January 2025 and we may update it at any time. The latest version will be made available on our recruitment site.

If you have any questions about this privacy notice, or how we collect or use your information, please contact our Group Data Protection Officer at:

 

C&C Group plc

Wellpark Brewery
161 Duke Street
Glasgow
G31 1JD

Email - gdpr@candcgroup.com

 

It is important that you read this notice, together with any other privacy information we may provide on specific occasions, so that you are aware of how and why we are using your information.

Your duty to inform us of changes
It is important that the personal information we hold about you is accurate and up to date. Please keep us informed if your personal information changes during the recruitment process.

If you fail to provide personal information
If you fail to provide certain information when requested we may not be able to consider you for a role or fully conduct the recruitment process, or we may be prevented from complying with our legal obligations (such as to ensure the health and safety of our workers).

Information we collect and hold about you
We will use your personal data to assess your suitability for the role you have applied for, and to verify the information you provide in your application. We are also under a legal obligation to conduct checks around your right to work.

Where relevant to the role, and if we make a conditional offer of employment, we will carry out additional pre-employment checks (including Directorship, criminal record (where permitted by law), financial integrity, electoral register, professional memberships, educational verification, and employment history). You will be informed if the role is subject to this level of screening as part of the recruitment process.

We have partnered with VeroScreening Limited, trading as ‘Accurate’, to help us conduct our pre-employment checks. Right to work checks can also be coordinated through Accurate, with the digital identity company ‘Yoti’ completing these checks. Please note that Yoti are a separate data controller, and their privacy notice can be found here.

If you would rather not use Yoti to complete the right to work check, please let our Talent Team know and we can arrange for this check to be completed manually.

We will collect, store, and use the following categories of personal information during the application and recruitment process:

• Information about who you are e.g. your name, date of birth, address, contact details, National Insurance number, passport, and visa and ‘Right to Work’ details.
• Information about your previous employment e.g. job titles, work history, working hours, training records, references, and professional memberships.
• Compensation history including salary, annual leave, pension, and benefits information.
• Information connected to your education including educational establishments attended, grades and qualifications achieved.
• Other information gathered during the recruitment process e.g. other information included in a CV or cover letter or as part of the application process, contact with us during meetings, phone calls, emails/ letters, and interview comments and notes.
• Information classed as ‘special category’ (sensitive) data relating to your health, race, ethnicity, religious beliefs, or sexual orientation.

We collect personal information either directly from you or from the employment agency representing you. We may collect additional information from third parties including former employers, employment agencies or references that you provide.

How we use special category data
Special Category personal data is more sensitive personal data that can reveal racial or ethnic origin, religious or philosophical beliefs, health data, genetic or biometric data, trade union membership, sex life or sexual orientation. 

During the recruitment process you might provide or disclose Special Category data, for example within your CV or during calls or interviews. We may also need to process this type of information to ensure we can meet our legal obligation to make any reasonable and necessary adjustments to enable you to participate in the recruitment process e.g. attend an interview or take a written assessment.

Where you elect to provide it, we will use anonymised information about your race, nationality, or ethnic origin, religious, philosophical or religious beliefs, or your sexual orientation, to ensure meaningful equal opportunity monitoring and reporting. The provision of this information is voluntary and your decision to provide or withhold it will not impact the outcome of your application; it will only be used for the purposes of diversity monitoring and will not be stored with your application.

Please be aware that this information is for equality monitoring purposes only and responses are not individually reviewed. Therefore, if you feel you may need or benefit from adjustments to our recruitment and selection processes, please contact careers@candcgroup.com so we may discuss these with you.

Information about criminal convictions
To the extent allowed under applicable law, and if relevant to the role, we may carry out a ‘basic’ criminal record check. We use this information to assess your suitability for the role, and to protect our interests. You will be notified in advance if this type of check is required for the vacancy.

Why we use your information
We will only use your personal information when the law allows us to. Most commonly, we will use your personal information in the following circumstances:

1. Where it is necessary to enter into a contract of employment with you, including to enable us to establish whether to enter into such a contract.

2. Where it is necessary to comply with a legal obligation, for example, confirming your right to work in the country where the role is based.

3. Where it is necessary for our legitimate interests (or those of a third party), such as selecting suitable employees.

4. Where you have given us your consent (or explicit consent for Special Category data) to use your information, for example, where you have not been successful in a particular role but we request to keep your information on our records so we can contact you about other opportunities that might arise, or where you have voluntarily provided us with your equality monitoring data.

5. Where it is necessary for the establishment, exercise or defence of legal claims.

6. Where it is necessary for the purposes of preventative or occupational medicine and assessing your working capacity as a potential employee.

7. Where Special Category data is necessary for reasons of substantial public interest, as defined in data protection law, such as for equal opportunities monitoring.

8. As permitted by applicable law.

Data sharing
We may have to share your data with third parties, including third-party service providers and other entities in our Group. We will only do this when it is fair and lawful to do so.

We will share your information with:

- pre-employment screening and background check providers. They, in turn, will use that information to complete all relevant searches, including sharing it with other third parties such as credit reference agencies, and your previous employers.

- companies we have chosen to support us in the recruitment process e.g. recruitment agencies.

- other parts of C&C Group plc. in the context of a business reorganisation or group restructuring exercise, for system maintenance support and hosting of data.

- law enforcement and other appointed agencies who support us (or where they request the information) in the prevention and detection of crime.

- We may share your personal information with other third parties, for example in the context of the possible sale or restructuring of the business.

- We may also need to share your personal information with a regulator or to otherwise comply with the law.

Before disclosing your personal information to such third parties we will take appropriate steps to ensure that those persons are authorised to receive your information, will treat your personal information as confidential and that they will not use such information for any purposes other than within the scope specified by and / or agreed with the Group.

We use the Harbour recruitment management system operated by 3D MarComms Limited (“Harbour”) to capture, store, view, change and otherwise process personal information as part of our recruitment process. Harbour are defined as a data processor for C&C Group, and will only process personal data as instructed by us.

How long we’ll keep your information
If you are unsuccessful in applying for a role, we will keep your data for six months before securely destroying it.

If you ask us to retain your personal information on file, on the basis that a further opportunity may arise in future and you wish to be considered for that (our ‘Talent Bank’), we will keep your data on file for six months before securely destroying it.

If you are successful we will process your personal information in line with our obligations in relation to your contract of employment and will securely destroy your personal information after six years of leaving our employment. 

Your rights in connection with personal information

By law you have the right to:

• Request access to your personal information (commonly known as a "data subject access request"). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
• Request the correction of incomplete or inaccurate personal information that we hold about you.
• Request erasure of your personal information in certain circumstances. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
• Object to processing of your personal information in certain circumstances.
• Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
• Request the transfer of your personal information to another party.
• Request a review of any processing decision made about you using a solely automated process. Please be advised that we do not generally anticipate that we will make decisions about candidates based solely on automated means, but if we do you will be made aware of this and you have the right to contest any decision made and ask that it is reviewed.

If you want to exercise any of these rights please contact GDPR@candcgroup.com.

Right to withdraw consent
In circumstances where your consent is the lawful basis for the processing, you have the right to withdraw your consent at any time. To withdraw your consent, please contact GDPR@candcgroup.com.  

Right to complain to a data protection regulator
We strive to collect, use and safeguard your personal information in line with data protection laws and guidance. If you do not believe we have handled your personal data appropriately, please get in touch with our Data Protection Officer (details above) so that we can try to resolve your concerns.

While we hope that we can resolve any concerns with you, you do have the option to complain to a data protection authority:

UK Information Commissioner’s Office (ICO) – https://ico.org.uk

Irish Data Protection Commission (DPC) – https://www.dataprotection.ie