Privacy policy for the Lifearc employer branding and recruitment
Date of publication: 3 June 2026
LifeArc is committed to respecting the privacy and protecting the security of your personal
information. This privacy notice describes how we collect and use personal information about you in accordance with the UK Data Protection legislation. It explains what personal data we will hold about you, how we collect it and what use we may make of that data, including sharing it, during the recruitment process. It also describes your data protection rights, including a right to object to some of the processing which LifeArc carries out.
More information about your rights, and how to exercise them, is set out in the "Your rights"
section.
Please read this notice and any other notice we may provide to you when we collect or process personal information about you. If you have any queries about data protection or your rights under this notice, please contact us using the contact details provided at the end of this notice.
This notice is non-contractual and LifeArc may update it at any time.
Who is the data controller?
LifeArc is the “controller” of your personal data. This means that we are responsible for how your personal information is processed. LifeArc is a charity registered with the Charity Commission for England and Wales no. 1015243 and a charity registered in Scotland with the Office of the Scottish Charity Regulator no. SC037861. LifeArc is also a company limited by guarantee no. 2698321 incorporated in England and Wales. LifeArc is registered with the Information Commissioner’s Office no. Z6907935.
What types of personal information do we collect about you?
Personal information is any information about an individual from which that individual can be directly or indirectly identified. There are also “special categories” of personal information, and personal information on criminal convictions and offences, which require a higher level of protection because they are of a more sensitive nature. The data we may collect during the recruitment process includes:
•your referral source – the website where you saw the job advert
• your contact details, including your name, title, address, telephone number and email
address;
• date of birth
• biometric data such as photographs, including those on passports and driving
licences;
• personal information included in a CV, application form, covering letter or interview
notes;
• details of your education, academic and professional qualifications, skills, experience
and employment history, including start and end dates, with previous employers as
well as any references taken up during the recruitment process;
• assessment results, if applicable;
• your preferences for location, type and hours of work with us;
• information about your current level of pay, including entitlement to any benefits
connected to your employment;
• your nationality and entitlement to work in the UK, and any personal information
contained in proof of right to work documentation;
• information available from public sources, such as news and social media reports or
Companies House;
• details about medical or health conditions, including whether or not you have a
disability for which we need to make reasonable adjustments during the recruitment
process (special category data); and
• Equity, diversity & inclusion monitoring information including about protected
characteristics such as your ethnic origin, sexual orientation, religion or belief and
information related to disability, in order to make any reasonable adjustments (special
category data).
How do we collect your personal information?
We may collect this information in a variety of ways. Most information will be collected directly from you. For example, data might be collected through application forms, CVs or letters, emails or phone calls, obtained from your passport or other identity documents, or collected from you through interviews or other forms of assessment. We may also collect personal data about you from third parties, such as your recruitment agency, former employers, a relevant professional body, external organisations who carry out right to work checks, the Disclosure and Barring Service (where applicable and/or required for specific roles), the Home Office and, where applicable, external bodies which arrange assessments of applicants. Data will be stored in a range of different places, including on your application record, in our HR management systems and in other IT systems, such as our email system.
What if you do not provide personal data?
You are under no legal or contractual obligation to provide data to LifeArc during the recruitment process. However, if you do not provide the information, we may not be able to process your application properly or at all. In relation to certain information, such as evidence relating to your right to work in the UK, we are under a legal obligation to obtain that information and, if you do not provide it, then we will be unable to offer you employment.
Automated Decision-Making
Automated decision making occurs when an electronic system uses your personal
information to make a decision without human intervention. We do not envisage that any recruitment decisions will be taken about you based solely on
automated decision-making, including profiling.
Why do we need your personal data and how do we use it?
We will only use your personal information when the law allows us to. These are known as the legal bases for processing. We will use your personal information in one or more of the following circumstances:
• where we need to do so to take steps at your request prior to entering into a contract
with you, or to enter into a contract with you
• where we need to comply with a legal obligation
• where it is necessary for our legitimate interests (or those of a third party), and your
interests or your fundamental rights and freedoms do not override our interests.
We process most of the personal information listed under “What types of personal
information do we collect about you?” in order to take steps at your request to enter into a
contract with you, and then to enter into a contract with you (if your application is successful) or to comply with our legal obligations, such as ensuring that you have the right to work in the UK.
We may also process your data to respond to and defend legal claims, make disclosures to
law enforcement agencies or in relation to health and safety compliance and/or for auditing
and regulatory purposes.
In other cases, we have a legitimate interest in processing personal data during the
recruitment process and for keeping records about the process. Processing data from
applicants allows us to properly and consistently manage the recruitment process, assess
and confirm an applicant’s suitability for employment and decide whether an applicant should be offered employment. Where we rely on legitimate interests as the justification for
processing personal data, we have carried out a balancing exercise in respect of those
interests compared to the rights enjoyed by individuals and you can obtain more information about this from the HR Department.
The purposes for which we are processing, or will process, your personal information are
to:
• manage the recruitment process and assess your suitability for employment or
engagement
• decide to whom to offer a job
• seek feedback from applicants on the recruitment process
• comply with statutory and/or regulatory requirements and obligations, e.g. checking
your right to work in the UK
• comply with the duty to make reasonable adjustments for disabled job applicants
and with other disability discrimination obligations
• ensure compliance with your statutory rights
• ensure effective HR, personnel management and business administration
• monitor equity, diversity and inclusion in employment
• enable us to establish, exercise or defend possible legal claims
Please note that we may process your personal information without your consent, in
compliance with these rules, where this is required or permitted by law.
In relation to special categories of personal data, we may process information related to a
disability/disabilities if we need to make reasonable adjustments to the recruitment process for candidates who have a disability. This is in order to comply with our employment law obligations and exercise specific rights in relation to employment.
Where we process other special categories of personal data (protected characteristics), such as information about ethnic origin, sexual orientation or religion or belief, this is done for the purposes of monitoring equity, diversity and inclusion. This is in order that we can promote and maintain equity of opportunity, and also in order that we can carry out monitoring which is for reasons of substantial public interest for the purpose of keeping our progress in relation to equity, diversity and inclusion under review. Sensitive personal information used for these purposes is either anonymised or collected with your explicit written consent. All information provided for the purposes of equal opportunities monitoring will be treated in confidence and will not be accessed by staff directly involved in the appointment. The information will not be reviewed with your application form. It is entirely your choice whether to provide such personal information. All applicants will be treated the same whether or not they choose to provide this information, but we do encourage you to do so, to help us advance equity
diversity and inclusion at LifeArc.
What if you want to use my information for a different purpose?
We will only use your personal information for the purposes for which we have collected it – i.e. for recruitment to the role you have applied for. However, if you are unsuccessful for the role you are applying for, we may invite you to apply for other opportunities, please see For how long do we keep data? for more details on this.
Who has access to your personal information?
Your information will be shared internally for the purposes of the recruitment exercise. This
includes members of the HR and recruitment team, interviewers involved in the recruitment
process, relevant managers in the business and IT staff, if access to the data is necessary for the performance of their roles. We will also share information about your application with your recruitment agency, if applicable. People involved in shortlisting and interviewing applicants will not have access to personal information provided for the purposes of monitoring equity, diversity and inclusion, but interviewers will be made aware of any reasonable adjustments required because of a disability.
We share your data with third parties which provide IT hosting services to us under contract in connection with the operation of the application system. If your application for employment is successful, then your data will be shared further for the purposes of managing both the business and the employment relationship, and a further privacy notice will be issued to you explaining how and why we will use your personal data as an employee. In addition, we will share limited information about successful applicants with a third party which provides employment screening services. They will provide their own privacy notice.
How do we protect data?
We take the security of your data seriously and are committed to taking all reasonable steps to protect the data we hold. We have a range of internal policies and security controls in place to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by our employees who need such access in the proper performance of their duties. We also have procedures and measures in place to address and respond to any potential data breach. Our security measures are kept under review and updated and enhanced as appropriate. When your data is shared with third parties, we do so on the basis that they have entered into a written agreement with us to ensure the security of the data by implementing appropriate safeguards and technical measures.
As our applicant tracking system (Teamtailor) stores data in Ireland, your data is transferred outside of the UK. When we transfer information outside of the UK, we ensure that it is protected by using one of the following safeguards:
Transferring the data to a non-UK country which the UK has decided provides the same level of protection as required within the UK (such as Ireland and other countries within the European Economic Area).
Entering into a contract with the recipient of the data which requires them to protect it to the same standards as required within the UK.
For how long do we keep data?
If your application for employment is unsuccessful, we will hold your data on file for 12
months after the application date. During this 12 month period we may contact you to invite you to apply for another role, should you then apply for another role the 12 month retention period will reset to the new application date. At the end of the 12 month retention period, or if you withdraw your consent (if applicable), your data will be anonymised or deleted.
If your application for employment is successful, personal data gathered during the
recruitment process will be transferred to further internal systems and retained during your
employment. As mentioned above, a new privacy notice will then apply explaining how and
why your data will be processed and retained if you enter into employment with us.
Your rights
As a data subject, you have a number of rights. You may be able, subject to the limitations m
• Make a data subject access request. You are entitled to receive a copy of the
personal data we hold about you and to check that we are lawfully processing it.
• Request correction of the personal data that we hold about you.
• Request erasure of your personal data. You are entitled to ask us to delete or remove
personal data where there is no good reason for us continuing to process it. You also
have the right to ask us to delete or remove your personal data where you have
exercised your right to object to processing (see below). Any requests for erasure will
be considered in line with our retention policy and subject to, for example, whether
the data may need to be retained in order to defend any legal claims, either actual or
potential.
• Object to processing of your personal data where we are relying on a legitimate
interest (or those of a third party) and your particular circumstances mean that you
want to object to processing on this ground.
• Request the restriction of processing of your personal data. This enables you to ask
us to suspend the processing of personal data about you, for example if you want us
to establish its accuracy or the reason for processing it.
• Request the transfer of your personal data to another data controller.
These rights may be limited, for example if fulfilling your request would reveal personal data about another person, where you object to us processing personal data but we have a
compelling justification for continuing to process it, or you ask us to erase information which we are required by law to keep or have another compelling reason to retain it. As indicated above, not all rights set out above apply to every type of data processing, and relevant exemptions are also included within the data protection laws that apply in the UK. We will inform you of any relevant exemptions that apply and which we rely upon when responding to any request you make.
If you would like to exercise any of these rights in relation to recruitment, please contact us at recruitment@lifearc.org
If you have a complaint about how your data has been handled, please contact our Data Protection Officer (DPO) using the contact details below. Please provide as much information as possible about your complaint. This will help us to understand the issue and investigate it thoroughly.
We will acknowledge receipt of your complaint within three working days. We will then investigate the matter and provide a full response within 30 calendar days. Throughout this process, we will:
Keep you informed of our progress;
Request any additional information we require in a timely and proportionate manner; and
Provide a clear and comprehensive outcome of our investigation.
If you are not satisfied with the outcome of your complaint, you have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues. Please visit the ICO website for details on how to contact them.
We have appointed a DPO who is responsible for overseeing questions in relation to this privacy policy. If you have any questions about this privacy policy, please contact the DPO using the details set out below.
LifeArc DPO: Data Governance Lead
Email: dataprivacy@lifearc.org
Postal address: LifeArc, Lynton House, 7-12 Tavistock Square, London, WC1H 9LT
Telephone number: +44 (0) 20 7391 2700
