Data Collection and Use
We collect, process and hold personal data relating to your job application. In most cases, this is limited to basic details. In some circumstances, we may also process special category personal data where it has been voluntarily provided, as explained below. The types of information we may collect include your name, email address, other contact details, employment history, qualifications, CV’s, cover letters and application forms, interview notes and assessment outcomes, equality monitoring data where voluntarily provided. The specific details of what we collect, why we collect it, how we use it, how long we keep it, and the lawful bases we rely on for processing your personal data are outlined in this policy.
Lawful Basis for Processing
We process personal data collected during the recruitment process in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. The lawful bases we rely on are:
- Legitimate interests – where processing is necessary for the purposes of recruiting staff, assessing suitability for roles, managing the recruitment process, and making hiring decisions. We have balanced these interests against the rights and freedoms of applicants.
- Contractual necessity – where processing is necessary to take steps at your request prior to entering into an employment or worker contract.
- Legal obligation – where processing is required to comply with legal obligations, including right to work checks and other statutory requirements.
Where we process special category data (for example, information relating to equality, diversity or disability), this is done only where it has been voluntarily provided and solely for monitoring and reporting purposes. This processing is carried out under Article 9(2)(b) UK GDPR and Schedule 1 of the Data Protection Act 2018 and does not form part of the selection or decision‑making process.
What Information We Collect
We only allow approved staff and trusted service providers to handle your personal information. We may also share your personal data with trusted third-party service providers who support our recruitment process, such as applicant tracking systems, recruitment platforms, background check providers or IT service providers. These providers process personal data on our behalf under contractual agreements that ensure appropriate data protection safeguards.
We do not sell or trade your personal details. We will not share your information with other organisations unless:
- you have given us permission, or
- the law requires us to do so.
We collect and process a range of information solely for recruitment and reporting purposes, including:
- Your name, address and contact details, including email address and telephone number
- Details of your qualifications, skills, experience and employment history, including any start and end dates you choose to share
- Voluntary disclosure information for reporting purposes only
Special Category Data
In some circumstances, we may collect special category personal data during the recruitment process. This includes information relating to equality, diversity or disability where you choose to provide this voluntarily.
Special category data is collected and processed solely for the purposes of monitoring equality of opportunity and diversity, and to meet our legal and reporting obligations. It is not used as part of the selection, assessment or decision‑making process.
The lawful basis for processing special category data is Article 9(2)(b) and/or Article 9(2)(g) of the UK General Data Protection Regulation, in conjunction with our obligations under employment and equality legislation.
Access to special category data is restricted to authorised members of the People team and is handled separately from recruitment decision‑making information. Appropriate technical and organisational measures are in place to protect this data.
Data Retention
We retain your personal data only as long as necessary for the purposes for which it was provided. We will only keep your data for longer if you authorise us to do so or if required by law. Specifically, your data will be kept as follows:
- For 12 months from the decision regarding your application
- After 12 months from the decision regarding your application, your data will be purged
- If you apply for another position or are in the process of an application during this initial 12‑month period, the retention period recommences from the date of the new application, and your data is kept for another 12 months
- If you are successful, your name, address and contact details will be retained for employment and contracting purposes. Once employed, our Staff Privacy Policy will then apply
- We retain applicant data for up to 12 months to allow us to respond to queries, manage recruitment records and consider candidates for future roles where appropriate.
Access to Your Data
Your information may be shared internally with members of the People team, site staff, administrators or other relevant managers, but only in relation to recruitment activities. Only those who have received the necessary training and understand their responsibilities under the legislation will have access. Your data will be held within the recruitment system and as specified in this policy.
Data Security
We implement appropriate technical and organisational security measures to protect personal data against unauthorised access, loss, misuse or disclosure.
Your Rights
You have the right to access, correct, update, transfer or delete the personal data we hold about you. You also have the right to object to processing, request restriction of processing, and to withdraw consent where processing is based on consent.
To exercise these rights, contact the People Team or the General Manager at the location to which you applied. If you wish to raise a complaint or have a general data privacy query, contact our People Team at [email protected] or write to Unit 202 Vanilla Factory, 39 Fleet Street, Liverpool, L1 4AR.
If you believe we have not complied with your data protection rights, you may also contact the Information Commissioner. ICO Helpline: 0303 123 1113.
Automated Decision‑Making
We do not use automated decision‑making or profiling as part of our recruitment processes.
Notification of Data Breaches
If a data breach occurs, we will notify you in accordance with our legal obligations. In the event that you discover or are notified of a data privacy breach, please write to the People Team at the above address, providing your contact information and key details of the breach.
If you believe we have not complied with your data protection rights, you may contact the Information Commissioner’s Office (ICO):
https://ico.org.uk
Helpline: 0303 123 1113
Changes to This Policy
We may occasionally modify this policy. If we do, we will provide details of any changes on our website or through direct communication.
Links to Other Websites
This privacy statement applies only to The Climbing Hangar. We are not responsible for the privacy practices of third‑party websites.
Policy Review
This policy is subject to regular review to ensure ongoing compliance with applicable laws and best practices. Reviews are conducted by the People Department. Any updates or changes are documented and communicated to relevant stakeholders.
Last reviewed 23 March 2026