1. Introduction

You are receiving this Recruiting Privacy Notice because you've either applied for a role with us, been contacted by our Talent team, or been invited to take part in our recruitment process.

This Recruiting Privacy Notice explains how we collect, process, store, and protect information throughout the recruitment process, from your initial application through to a final hiring decision.

It applies to all candidates, regardless of how they enter our recruitment process, including those who:

Apply directly for a role
Are referred by an employee, agency or third party
Are approached by our recruiters
Are invited to apply for an opportunity with us.

This Notice also explains how we use our Applicant Tracking System (ATS) and other tools that help us manage recruitment, communicate with candidates, review applications, schedule interviews, and keep appropriate recruitment records.

2. Who We Are and Our Role as Data Controller

For the purposes of this Recruiting Privacy Notice, LEVEL UP INTERACTIVE SERVICES LIMITED, a private limited company registered in England and Wales under company number 16325434, with its registered office at 19 Leyden Street, London, England, E1 7LE, is the data controller responsible for the processing of your personal information in connection with our recruitment activities.

A data controller is the organisation that decides why and how personal information is collected and used. This means that we determine the purposes and means of processing candidate information during the recruitment process, including how applications are reviewed, how candidates are contacted, how recruitment records are stored, and how hiring-related decisions are documented.

3. Collection of Information

As part of the recruitment process, we collect information that helps us assess candidates and manage recruitment activities. This includes personal information that identifies you, or could reasonably be used to identify you.

In simple terms, this includes information that tells us who you are, how we can contact you, what your experience is, or anything else that can reasonably be linked to you as a candidate.

During recruitment, we may collect the following types of information:

Contact details (name, email, phone number, address)
Information from Resume/CV (education, employment history, skills, qualifications)
References and contact details of referees
Data from interview notes and assessments
Data automatically collected through the ATS (application history, communications)
Any other information you, as a candidate, voluntarily provide to us that is relevant to your application

Some types of information are more sensitive because they relate to private information about a person. This is often called sensitive data or special category data. Examples include information about health, disability, racial or ethnic origin, religious beliefs, political opinions, trade union membership, biometric data, or sexual orientation.

We do not ask candidates to provide sensitive or special categories of data. If we receive this information, we will handle it with additional care and apply appropriate safeguards to protect it, including limiting access to authorised personnel and ensuring it’s stored securely.

4. Purpose of Information Processing

We use candidate information to:

Assess qualifications, skills and experience for current opportunities
Review and progress applications through our recruitment process
Communicate with candidates throughout the hiring process
Schedule and conduct interviews and assessments
Comply with applicable laws and regulations
Prepare employment offers and related contractual documentation where applicable.

5. Legal Basis for Processing

We only use candidate information when we have a valid legal reason to do so. This is called a “legal basis” for processing.

In the recruitment process, we usually rely on the following legal bases:

Legitimate interest

In most cases, we process candidate information because it is necessary for our legitimate interest in managing the recruitment process and selecting suitable candidates.

This includes using your personal data to:

Review your application;
Assess your qualifications, skills and experience;
Communicate with you about the recruitment process;
Schedule and conduct interviews;
Keep internal notes and assessments;
Manage the recruitment process through our recruitment platform.

We use this legal basis only where our interest in managing recruitment does not unfairly affect your privacy rights.

Steps before entering into a contract

If your application progresses, we may need to process certain information because it is necessary before entering into an employment or service contract with you.

This may include:

Confirming your identity;
Discussing employment terms;
Preparing an offer;
Taking steps needed before signing an employment agreement or similar contract.

Consent

In limited cases, we may ask for your consent to process specific information.

This may apply, for example, where:

We want to keep your application for future job opportunities after the standard retention period
We ask you to provide optional diversity information.

Where we rely on consent, we will explain what we are asking for and why. You can refuse consent or withdraw it later. Refusing or withdrawing consent will not affect your application unless the information is necessary for a specific recruitment step.

6. Retention of Information

We keep candidate information only for as long as reasonably necessary for the purposes for which it was collected and used during the recruitment process. As a standard rule, candidate information is retained for 12 months from the moment you submit your application, unless a longer retention period is required or permitted by applicable law or you have provided your consent for longer retention of your information.

We apply this 12-month retention period because it allows us to:

Complete and properly document the recruitment process
Communicate with candidates about their application and any related follow-up
Consider candidates for other suitable roles that may become available within a reasonable period
Maintain a record of recruitment decisions and the reasons for those decisions
Respond to candidate questions, requests, complaints, or disputes
Protect our legal rights and demonstrate that the recruitment process was conducted fairly, consistently and in accordance with applicable law

After the applicable retention period expires, candidate information will be deleted or anonymized, unless we are required or permitted to keep certain information for a longer period under applicable law or we got your consent to retain your information.

Our ATS supports automated deletion or anonymization of candidate information after the relevant retention period has expired. Where appropriate, candidates may be asked whether they agree to extend the retention of their information for future job opportunities. This may be done through an automated communication before the expiry of the standard retention period. If you do not agree to such extension your information will be deleted or anonymized after the standard retention period, unless we have another lawful reason to keep limited information.

If you are hired, some of the information collected during recruitment may become part of your employment record. In that case, it will be handled in accordance with our employee privacy rules and applicable retention periods.

We may keep certain limited records for a longer period where this is necessary to comply with applicable legal obligations, resolve disputes, protect our legal rights or respond to lawful requests from authorities.

7. Security

We take protecting your information seriously and have measures in place to help keep it secure.

We use appropriate technical and organisational safeguards designed to protect candidate information against unauthorized access, accidental loss, misuse, alteration, disclosure or deletion.

These safeguards may include:

Restricting access to candidate information to people who need it for recruitment, HR, legal, compliance or IT support purposes
Using secure recruitment systems and access controls
Applying authentication measures to protect user accounts
Protecting information during storage and transfer where appropriate
Keeping records of access and activity where technically available
Reviewing and removing access rights when they are no longer needed
Requiring confidentiality from employees, interviewers, recruiters and service providers who may access candidate information
Working with trusted service providers that are expected to apply appropriate security standards
Taking steps to identify, investigate and respond to security incidents

We also aim to ensure that candidate information is only shared internally on a need-to-know basis. For example, hiring managers and interviewers may access information relevant to the recruitment process but they should not access other candidate information unless they are involved in the relevant hiring decision.

Where we use recruitment platforms or other service providers, we expect them to maintain appropriate privacy and security standards and we take steps to assess those standards where appropriate..

No system can be guaranteed to be completely secure. However, we work continuously to protect candidate information and reduce the risk of unauthorized access, loss, misuse or disclosure. If we become aware of a security incident involving candidate information, we will investigate, respond appropriately, and notify affected individuals and/or relevant authorities where required by law.

8. Sharing and Disclosure of Information

We share candidate information only where this is necessary for recruitment-related purposes, where we have a valid reason to do so, and where appropriate safeguards are in place.

Candidate information may be shared with the following categories of recipients:

Internal teams involved in recruitment

Candidate information may be shared with employees who are involved in the recruitment process, such as HR and Talent team members, hiring managers, interviewers and IT staff.

Access is provided only where it is needed for recruitment, decision-making, administration, technical support, or compliance purposes.

Recruitment agencies and external recruiters

Where we work with recruitment agencies or external recruiters, we may share candidate information with them or receive candidate information from them. This is done only where they assist us with identifying, assessing, or communicating with candidates.

Recruitment platforms and service providers

We may use recruitment platforms, applicant tracking systems, communication tools, scheduling tools, cloud hosting providers, and other service providers that help us manage the recruitment process.

These providers may process candidate information on our behalf and are expected to protect it in accordance with applicable data protection and confidentiality requirements.

Group companies

Candidate information may be shared within our group companies where this is necessary for recruitment, HR administration, internal decision-making, compliance, reporting, or managing global recruitment operations.

Where candidate information is shared within the group, access is limited to people who need the information for a legitimate recruitment-related purpose. Group companies are required to follow confidentiality and data protection obligations.

Authorities, courts, or professional advisers

In limited cases, we may share candidate information with public authorities, regulators, courts, external lawyers, auditors, insurers, or other professional advisers where this is required by law, necessary to protect our legal rights, or needed to respond to lawful requests.

9. Candidate Rights

We are committed to following high standards of data protection and to respecting the rights of candidates in relation to their information.

Depending on the applicable data protection laws and the circumstances of the processing, you may have the following rights regarding your personal information:

Access – to request a copy of the personal information we hold about you.
Correction – to ask us to correct inaccurate or incomplete personal information.
Erasure – to request deletion of your personal information in certain circumstances.
Restriction – to ask us to limit how your personal information is processed in certain cases.
Portability – to receive certain personal information in a structured, commonly used and machine-readable format and transfer it to another organization (where applicable).
Objection – to object to processing based on our legitimate interests, including withdrawal from recruitment.
Automated decisions – to request human review if decisions affecting you have been made solely by automated means.
Complaint – to lodge a complaint with the data protection authority or regulator, where you believe that your information has not been handled properly.

Candidates located in certain jurisdictions may have additional rights under local law, which we will respect where relevant.

You can exercise these rights or ask questions about how your information is handled by contacting the personnel responsible for data protection at dataprotection@levelupinteractive.co.uk

10. International or intra-group data transfers

As part of our recruitment process, candidate information may be accessed, shared, or stored in countries different from the country where the candidate is located or where the company is located. This may happen, for example, where we use group companies, recruitment teams, service providers, or recruitment platforms that operate internationally.

Where candidate information is shared internationally, we take steps to ensure that the information remains protected and that appropriate safeguards are applied in line with applicable data protection laws.

If candidate information is transferred from the European Economic Area (EEA), the United Kingdom, or Switzerland to a country that is not recognized as providing an adequate level of data protection, we will use appropriate transfer safeguards where required. These may include Standard Contractual Clauses, equivalent contractual protections, or other legally recognized transfer mechanisms.

We also aim to limit international sharing to the information that is necessary for the relevant recruitment-related purpose and to ensure that recipients are subject to appropriate confidentiality, privacy, and security obligations.

Where we use recruitment platforms or other service providers that support our recruitment process, we expect them to apply appropriate safeguards for international transfers and to protect candidate information in accordance with applicable data protection and security requirements.

11. Notice Updates

This Recruiting Privacy Notice is effective from 5th July 2026 and applies from that date until it is replaced or updated by a newer version.

We may update this Recruiting Privacy Notice from time to time to reflect changes in applicable laws, recruitment practices, internal processes, systems, or service providers.

When we make updates, we will indicate the date of the latest version. Where appropriate, we may also notify candidates of important changes through the recruitment platform, by email, or through another suitable communication channel.

The current version of this Notice will apply to the processing of candidate information during the recruitment process, unless a later version is provided or made available to you.

We maintain internal version control of this Notice to support transparency, accountability, and proper record-keeping.

If you have any further questions relating to this Notice or how your information is handled, please contact us via e-mail: dataprotection@levelupinteractive.co.uk