Privacy Notice for Recruitment and Employer Branding
Date of publication: 14th January 2026
1. Who we are
PPL (Private Public Ltd) is a social enterprise and B Corp registered as a limited company in England and Wales (company number 06405704). Registered office Unit 3, St Saviours Wharf, 23 Mill Street, London, SE1 2BE.
We are committed to treating candidates’ personal data with respect, transparency, and care throughout the recruitment process.
For the purposes of recruitment and employer branding, PPL is the Data Controller. This means we decide why and how your personal data is processed.
We use an applicant tracking system provided by TeamTailor, which acts as a Data Processor and processes personal data only on our documented instructions.
If you have any questions about this notice or how we handle your data, you can contact us at:
Email: recruitment@ppl.org.uk
2. What this privacy notice covers
This notice explains how we process personal data when:
- You visit our careers website
- You submit a speculative application or register interest in future roles
- You apply for a role with us
- We source your profile via platforms such as LinkedIn or job boards
- You are referred by a PPL employee or partner
- You act as a referee for a candidate
In this notice, “Candidate” refers to all of the above categories unless stated otherwise.
3. The legal framework we follow
We process personal data in accordance with:
- The UK General Data Protection Regulation (UK GDPR)
- The Data Protection Act 2018
The Information Commissioner’s Office (ICO) is our lead supervisory authority.
4. What personal data we collect
a) Data collected from all users of our careers site
- Device and technical information (IP address, browser type, operating system)
- Usage data (pages viewed, interaction with the site)
- Communications with us (emails, messages, application-related correspondence)
b) Data collected from candidates
- Contact details (name, email address, phone number)
- Application materials (CVs, cover letters, work samples)
- Interview notes, assessment outcome and other information related to the recruitment process
- Your video in case your application/ interview was performed through the video feature
- For referees, we process contact details and professional opinions provided in references.
- Criminal convictions and security vetting data, including DBS and BPSS checks, where required for certain roles.
- Information from public professional platforms (for example, LinkedIn)
Where we process special category personal data, we do so on the basis of our legitimate interests and/or legal obligations under Article 6(1)(f) and Article 6(1)(c) UK GDPR, together with the applicable condition under Article 9.
5. Where your data comes from
We collect personal data:
- Career site
- Directly from you
- From recruitment agencies or referrers
- Referees
- From public professional platforms
- When data received by email or referral is transferred into our applicant tracking system
Our applicant tracking system is used as the central system of record for recruitment data.
6. Why we process your personal data
We process personal data to:
- Manage recruitment and selection processes
- Communicate with candidates
- Assess suitability for current and future roles
- Administer referrals
- Support fair recruitment practices, including anonymised or “blinded” screening
- Where relevant, we may supplement application information with publicly available professional information (such as LinkedIn profiles) to verify experience and suitability
- Help service providers (such as TeamTailor and its processors and data providers) and Partners (such as job sites through which you may have applied) improve and develop their services
- Comply with legal obligations
- Protect our legal rights where necessary
We may use TeamTailor’s technology to help us select or rank appropriate candidates for us to consider based on criteria expressly identified by us, or typical in relation to the role for which you have applied. We do not make recruitment decisions based solely on automated processing that produces legal or similarly significant effects.
7. Legal bases for processing
We process personal and special category data on the basis of:
- Legitimate interests, to recruit fairly and efficiently
- Consent, where required (for example, if interviews were ever recorded)
- Legal obligations, where applicable
This is under the Article 6 UK GDPR, together with the applicable condition under Article 9. We have assessed that processing personal data for recruitment purposes is necessary for our legitimate interests and does not override candidates’ rights or freedoms.
Where we process criminal convictions or security check information (such as DBS or BPSS checks), we do so on the basis of Article 6(1)(c) UK GDPR (legal obligation) together with Article 10 UK GDPR. This information is used only for recruitment purposes and is handled with appropriate safeguards.
We do not rely on consent as a general basis for recruitment processing. Where consent is used (for example, for interview recordings), refusal or withdrawal will not disadvantage you in the recruitment process
8. Interview recording and assessments
We do not currently record interviews.
If this were to change in future, interviews would only be recorded with explicit prior consent, and candidates would be informed in advance.
9. How long we keep your data
Retention periods are based on business needs, legal requirements, and our ability to respond to potential legal claims.
Candidates
Unsuccessful candidates: retained for up to 24 months
Speculative or connecting candidates: retained for up to 24 months
Referees: retained in line with the associated candidate record
We periodically review inactive records and delete personal data where retention is no longer justified.
Retention period for analytic Cookies are set out in our Cookie Policy.
Visitors
Technical and security logs: retained for up to 12 months
Successful candidates
If you accept a role with us, your recruitment data will be retained and transferred into your employee record, and you will receive separate employee privacy information.
Candidates may request deletion earlier at any time, subject to legal requirements.
10. Deletion and backups
When personal data is deleted, it is removed from our active systems.
Residual copies may persist temporarily in secure backups in accordance with system retention practices. Backups are not used for operational processing and are overwritten in line with normal backup cycles.
11. Who we share data with
We may share personal data with:
- Our applicant tracking system provider
- Suppliers who provide services and functionality in our employment branding and recruitment process.
- Recruitment agencies acting on our instructions
- Professional advisers where legally required
- Companies providing cookies on the career site.
- Authorities or regulators where we are legally obliged to do so
- We do not share recruitment data with group companies or use it for marketing purposes.
12. International data transfers
Recruitment data is primarily processed within the UK and Ireland.
In limited circumstances, personal data may be accessed from outside the UK or EEA, for example where system support or maintenance is provided by approved sub-processors. Where this occurs, appropriate contractual and technical safeguards are in place in accordance with UK GDPR.
13. Your rights
You have the right to:
- Access your personal data
- Request correction of inaccurate data
- Request deletion of your data
- Object to or restrict processing
- Withdraw consent where applicable
- Lodge a complaint with the Information Commissioner’s Office
Requests can be made via the careers site or by emailing us directly via recruitment@ppl.org.uk
or write to us at PPL, Unit 3, St Saviours Wharf, 23 Mill Street, London, SE1 2BE.
14. Updates to this notice
We may update this privacy notice from time to time. The most recent version will always be available on our careers site.
