Skip to main content

We would like to use cookies to ensure we give you the best experience on our website. If you consent to us using cookies, please click on the tick, or view our privacy policy

Applicant Policy

Applicant data privacy policy


Penso is committed to ensuring that your privacy is protected. The purpose of this policy is to inform you about what personal information we collect whether this is through our website, the recruitment process, or other interaction with Penso. We will also define how we use the information, whether the information is disclosed and the ways in which we protect your privacy.

We want you to feel secure when interacting with Penso and are committed to respecting your privacy and complying with data privacy regulations, such as The General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679).

This policy explains what information we collect, how we protect any information you share with us, and how we use it.

Penso’s recruitment process

Penso is always looking for new people to join a variety of teams and disciplines within the business, helping us to effectively and sustainably achieve the aims and growth of the business. As part of our recruitment process we advertise roles internally, online and via social media, you can apply for these roles via our website and by providing us with your CV to

As part of any recruitment process, the organisation collects and processes personal data relating to job applicants. The organisation is committed to being transparent about how it collects and uses that data to meet its data protection obligations.

What happens to my personal data when I apply for a role at Penso?

When you apply for one of the Penso vacancies your information is submitted to our Human Resources department. The data you submit will then be shared with our professional recruiters, the relevant hiring manager, and other people within Penso who are part of the recruitment process for the specific role.

How long is my application information/personal information stored?

Your personal information will be stored with the Human Resources department for up to 12 months from submission. We retain your information in our system to help us maintain suitable records of how we manage the recruitment process and to help us improve and quality check the consistent approach we take. After the 12 months we will remove your data from our systems, unless your application has been successful and you have engaged in a contract with Penso.

If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your personnel file and retained during your employment. The periods for which your data will be held will be provided to you in a new privacy policy.

There might also be other Penso roles that you would suit and by storing your application for the duration of 12 months, we can make recommendations to you about other relevant roles.

The information you submit is processed under the lawful basis of legitimate interest. You are entitled to know what information we hold about you and for this to be corrected if it is inaccurate and you are also entitled to contact us at, if you do not want to be considered for other positions or would like to have your personal data removed from our system all together.

What information does the organisation collect?

The organisation collects a range of information about you. This may include but not limited to:

Your name, address and contact details, including email address and telephone number submitted via your CV, details of your qualifications, skills, experience and employment history information about your current level of remuneration, including benefit entitlements, whether or not you have a disability for which the organisation needs to make reasonable adjustments during the recruitment process, and information about your entitlement to work in the UK.

The organisation may collect this information in a variety of ways. For example, data might be contained in application forms, CVs, obtained from your passport or other identity documents, or collected through interviews or other forms of assessment.

The organisation may also collect personal data about you from third parties, such as references supplied by former employers, information from employment background check providers, and information from criminal records checks. Once an offer of employment has been made the organisation may seek information from third parties and will inform you that it is doing so.

Data will be stored in a range of different places, including on your application record, in HR filing/ management systems and on other IT systems (including email).

Why does the organisation process personal data?

The organisation needs to process data to take steps at your request prior to entering into a contract with you. It may also need to process your data to enter into a contract with you.

In some cases, the organisation needs to process data to ensure that it is complying with its legal obligations. For example, it is required to check a successful applicant’s eligibility to work in the UK before employment starts.

The organisation has a legitimate interest in processing personal data during the recruitment process and for keeping records of the process. Processing data from job applicants allows the organisation to manage the recruitment process, assess and confirm a candidate’s suitability for employment and decide to whom to offer a job. The organisation may also need to process data from job applicants to respond to and defend against legal claims.

The organisation may process special categories of data, such as information about ethnic origin, sexual orientation or religion or belief, to monitor recruitment statistics. It may also collect information about whether or not applicants have any disabilities to make reasonable adjustments for candidates. The organisation processes such information to carry out its obligations and exercise specific rights in relation to employment.

For some roles, the organisation is obliged to seek information about criminal convictions and offences. Where the organisation seeks this information, it does so because it is necessary for it to carry out its obligations and exercise specific rights in relation to employment.

The organisation will not use your data for any purpose other than the recruitment exercise for which you have applied and will only keep the data for as long as necessary. The organisation will not transfer your data outside the European Economic Area.

How date the organisation protect data?

The organisation takes the security of your data seriously. Our internal systems are protected to ensure that unauthorised or unlawful processing of personal information, accidental loss or destruction of, or damage to, personal information does not occur. We continuously monitor our systems and update policies to ensure that your personal data is not easily accessed, except by our employees in the proper performance of their duties and as stated above.

What if you do not provide personal data?

You are under no statutory or contractual obligation to provide data to the organisation during the recruitment process. However, if you do not provide the information required, the organisation may not be able to process your application properly or at all.

Your rights

As a data subject, you have a number of rights. You can:

  • Access and obtain a copy of your data on request
  • Require the organisation to change incorrect or incomplete data
  • Require the organisation to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing, and
  • Object to the processing of your data except where retention of that personal information is required in the context of a legal dispute or as otherwise required by law and where the organisation is relying on its legitimate interests as the legal ground for processing.

If you would like to exercise any of these rights, or if you have any queries about this policy or your personal information generally, including questions about accessing your personal information or correcting it, please contact a member of the Human Resources team by emailing

If you believe that the organisation has not complied with your data protection rights, you can complain to the Information Commissioner. If access, correction, or deletion is denied, the reason for doing so will be communicated to you.

Changes to this privacy policy

As this Privacy Policy is updated, the current version will be posted on this site.