Last updated: January 2026

This Privacy Notice explains how ARW HR Limited ("we", "us", "our") collects, uses, stores and protects personal data about job applicants when we carry out recruitment activities on behalf of our clients.

We are committed to protecting your personal data and handling it in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

ARW HR is an HR consultancy providing HR support services to UK-based businesses.

For the purposes of recruitment activities:

• ARW HR acts as a data processor when recruiting on behalf of our clients.

• Our clients act as the data controller, as they determine how and why your personal data is used.

Our clients are responsible for providing their own privacy information to candidates explaining how they use personal data once it is shared with them.

If you have any questions about this Privacy Notice or how your data is handled, you can contact us at:

Email: amber@arwhr.co.uk

2. Personal data we collect

We may collect and process the following types of personal data during the recruitment process:

• Contact details (e.g. name, email address, phone number)

• Employment history and work experience

• Education, qualifications and training

• CVs, covering letters and application forms

• Interview notes and assessment outcomes

• Salary expectations and availability

• References and reference information (where applicable)

• Right to work documentation (e.g. passport, visa or share code information)

• Any other information you choose to provide as part of your application

We do not intentionally collect special category data unless it is necessary and relevant (for example, to make reasonable adjustments during the recruitment process). Where required, this data will be processed in line with UK GDPR requirements.

 3. How we collect your personal data 

We collect personal data from:

• You directly (e.g. via job applications, email, or during interviews)

• Job boards and recruitment platforms (e.g. Indeed)

• Referees (where applicable and with your consent)

4. Why we use your personal data

 We process your personal data for the following purposes:

• To manage and progress your job application

• To assess your suitability for a role

• To communicate with you about the recruitment process

• To share relevant information with our client

• To carry out pre-employment checks, including right to work checks

• To comply with legal and regulatory obligations

• To keep records relating to recruitment decisions

5. Lawful basis for processing

We process your personal data under the following lawful bases:

• Legitimate interests – to manage recruitment effectively and assess candidates

• Legal obligation – to carry out right to work checks and comply with employment law

• Consent – where required (for example, when contacting referees or holding your details for future roles). Where we rely on consent, you may withdraw this at any time.

 Where we process special category data, this will be done in accordance with UK GDPR requirements and only where necessary.

6. Right to work checks

As part of the recruitment process, we are required by law to verify that successful candidates have the legal right to work in the UK.

This may involve collecting and reviewing documents such as:

• Passports

• Biometric Residence Permits

• Visa documentation

• Home Office share codes

 Right to work information will be processed securely and only for the purpose of complying with our legal obligations. This information will be retained only for as long as legally required.

7. Who we share your data with

We may share your personal data with the following parties, and only where necessary for the recruitment process:

• Our client (the recruiting employer)

• Referees (with your consent)

We do not sell your personal data to third parties.

8. Data storage and security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss or misuse.

 Your data is stored securely and access is limited to those who need it for legitimate recruitment purposes.

9. How long we keep your data

We will retain your personal data only for as long as necessary for recruitment purposes.

Typically:

• If your application is unsuccessful, your data will be retained for up to 6 months after the recruitment process ends, unless you consent to a longer retention period.

• If your application is successful, relevant information will be transferred to the employer’s HR records.

10. Your data protection rights

Under UK GDPR, you have the right to:

• Access your personal data

• Request correction of inaccurate or incomplete data

• Request deletion of your data (in certain circumstances)

• Object to or restrict processing

• Request data portability

• Withdraw consent (where processing is based on consent)

To exercise your rights, please contact us using the details above. We may need to verify your identity before responding.

11. Complaints

If you have concerns about how your personal data is handled, you have the right to make a complaint to the Information Commissioner’s Office (ICO):

Website: www.ico.org.uk

We would encourage you to contact us first so we can try to resolve any concerns.

12. Changes to this Privacy Notice

We may update this Privacy Notice from time to time. Any changes will be posted on our website and, where appropriate, notified to applicants.