Privacy notice

1. Introduction

1.1 Sanctuary Search Ltd, trading as Sanctuary Graduates ("Sanctuary Graduates", "we", "us" or "our"), provides early careers recruitment, attraction, screening, assessment and candidate management services.

1.2 We are committed to protecting personal data and respecting individuals' privacy rights. This notice explains what personal data we collect, how and why we use it, who we may share it with, how long we keep it and the rights available to you.

1.3 This notice applies where Sanctuary Graduates acts as a controller of personal data, including where we determine the purposes and means of processing candidate, applicant or website-user information. In some client engagements we process personal data on behalf of an employer or other client as its processor. In those circumstances, the client determines the purposes and essential means of that processing and its privacy notice may also apply. We will process that data in accordance with the client's lawful documented instructions and the relevant contractual arrangements.

1.4 Our processing is governed by applicable UK data protection and privacy law, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Data (Use and Access) Act 2025 and, where relevant to cookies and electronic communications, the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), in each case as amended from time to time.

2. Who this notice applies to

2.1 This notice applies to candidates, applicants, students, graduates, apprentices, individuals registering an interest in opportunities, event attendees and other people who engage with our recruitment services or websites.

2.2 Some early careers opportunities may involve people under 18. Where we process personal data relating to younger candidates, we take appropriate care to provide clear information and apply proportionate safeguards, including the higher level of protection required where online services are likely to be accessed by children.

3. Personal data we may collect

3.1 Depending on the opportunity, campaign or service, we may process the following categories of personal data:

• identity and contact information, including your name, email address, telephone number and postal address;
• application and profile information, including your CV, education, qualifications, university, course, graduation year, employment history and other information you provide in an application;
• eligibility information, including information relevant to right to work, work authorisation, location or other role requirements where applicable;
• screening, interview and assessment information, including recruiter notes, responses, scores, outcomes, video or audio interview recordings and assessment records;
• communications and service records, including emails, telephone notes, feedback, candidate-support records and records of your interactions with us;
• technical and usage information, such as IP address, device/browser information, website interaction data and security logs where applicable;
• reasonable adjustment, accessibility or health information where this is relevant and lawfully provided; and
• diversity and equal opportunities information, such as ethnicity or other diversity information, where you choose to provide it and where we have an appropriate lawful basis and special category condition.

3.2 We seek to collect only the personal data reasonably necessary for the relevant recruitment, assessment or service-delivery purpose.

4. How we obtain your personal data

4.1 We may collect personal data directly from you when you apply for a role, register with us, complete an assessment or interview, attend an event, submit an enquiry or otherwise communicate with us.

4.2 We may also obtain personal data from other sources where lawful and appropriate, including:

• employers or clients who ask us to support a recruitment process;
• job boards, recruitment platforms, university or careers networks, student societies and other attraction channels;
• referees or other third parties where relevant to a recruitment process; and
• publicly available professional or career information where appropriate for recruitment activity.

4.3 Where we obtain personal data from another source, we will provide privacy information as required by law and will be as clear as reasonably possible about the source and categories of data obtained.

5. How we use your personal data

5.1 We may use personal data to:

• create and manage candidate registrations, profiles and applications;
• assess eligibility and suitability for roles, programmes and other opportunities;
• conduct screening, interviews, video interviews, assessments, shortlisting and related recruitment activity;
• communicate with you about applications, opportunities, interviews, assessments, events, deadlines and recruitment processes;
• provide candidate support, reasonable adjustments and accessibility arrangements;
• share relevant information with an employer or client where appropriate to progress a recruitment process;
• consider and contact you about other suitable opportunities where this is consistent with the information provided to you and an appropriate lawful basis;
• manage complaints, queries, safeguarding or welfare concerns and data protection rights requests;
• protect our systems, investigate incidents, prevent misuse and maintain appropriate business records;
• produce management information, audit information and diversity reporting, generally in aggregated or anonymised form where practical;
• improve our recruitment processes, candidate experience and service delivery; and
• comply with legal, regulatory, contractual and professional obligations and establish, exercise or defend legal claims.

6. Our lawful bases for processing

6.1 The lawful basis we rely on depends on the particular processing activity. We may rely on:

• legitimate interests – for example, operating and improving our recruitment services, administering candidate relationships, communicating about relevant opportunities, maintaining security, managing client delivery and protecting our legal or commercial interests, provided those interests are not overridden by your rights and freedoms;
• contract or steps taken at your request before entering into a contract – where processing is necessary to provide a recruitment service or take steps you have asked us to take;
• legal obligation – where we need to process information to comply with applicable law; and
• consent – where consent is appropriate for the particular activity.

6.2 Where we process special category data, we must have both an Article 6 lawful basis and an additional condition under Article 9 UK GDPR and, where required, Schedule 1 of the Data Protection Act 2018. Depending on the circumstances, this may include explicit consent, employment/social security/social protection obligations, or substantial public interest conditions such as equality of opportunity or treatment. Where a Schedule 1 condition requires an Appropriate Policy Document, we will maintain one.

6.3 Where consent is the basis used, it will be obtained appropriately and can be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.

6.4 Where we rely on legitimate interests, you have the right to object to the processing in certain circumstances. See section 14 below.

7. Information you need to provide

7.1 Some information is necessary for us to administer an application or assess eligibility for a particular opportunity. If you do not provide information that is reasonably required for that purpose, we may be unable to progress your application or provide the relevant service.

7.2 Where providing information is optional, such as certain diversity-monitoring information, we will make this clear where practical. Choosing not to provide optional diversity information will not in itself affect the assessment of your application.

8. Recruitment technology, video interviews and automated tools

8.1 We may use approved applicant tracking, video interview, assessment, screening and other recruitment technologies to deliver recruitment services efficiently and consistently.

8.2 Where a recruitment process includes a recorded one-way video interview, the approved video interview platform may process video and audio responses and, depending on the functionality of the platform used, may automatically generate a written transcript.

8.3 Some recruitment processes may use artificial intelligence, profiling or automated tools to assist with screening or assessment. Where these tools are used, we will consider privacy, fairness, accessibility and data-protection risks, including whether a Data Protection Impact Assessment is required.

8.4 Where technology supports a decision but a person remains meaningfully involved, the human reviewer is expected to consider the available information and not simply apply an automated recommendation without appropriate review.

8.5 If we use solely automated processing to make a decision about you that produces legal or similarly significant effects, we will ensure that we have an appropriate lawful basis and apply the safeguards required by UK data protection law. These include providing information about the decision, enabling you to make representations, obtain human intervention and contest the decision. Additional restrictions apply where special category personal data is involved.

8.6 Where required by law, we will provide meaningful information about the logic involved in significant solely automated decision-making, together with the significance and likely consequences for you.

9. Sharing your personal data

9.1 We may share personal data, where necessary and proportionate, with:

• employers and clients involved in opportunities or recruitment processes for which you are being considered;
• authorised Sanctuary Graduates employees, workers, contractors and delivery partners who need the information to perform their role;
• approved providers of applicant tracking, recruitment, screening, assessment, video interview, communications, hosting, cloud, analytics or other technology services;
• professional advisers, insurers, auditors and other service providers where appropriate;
• regulators, courts, law-enforcement bodies or other authorities where disclosure is required or permitted by law; and
• prospective purchasers, investors and their professional advisers in connection with a proposed or completed corporate transaction, subject to appropriate confidentiality and data-protection safeguards.

9.2 We require suppliers that process personal data on our behalf to be subject to proportionate due diligence and appropriate contractual, confidentiality, data-protection and security obligations.

10. International transfers

10.1 Some approved suppliers or service providers may process personal data, store it, or permit authorised access from locations outside the United Kingdom. Remote access from another country may also constitute an international transfer in some circumstances.

10.2 Where a restricted international transfer takes place, we will ensure that it is covered by a lawful transfer mechanism. This may include UK adequacy regulations (or other regulations approving transfers), the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses or another permitted safeguard or exception, as appropriate.

10.3 Where required, we will assess the protection available for the transfer and implement supplementary technical, organisational or contractual measures where needed so that the standard of protection is not materially lower than that provided under UK data protection law.

10.4 You may contact us using the details in section 17 if you would like further information about international transfers or the safeguards relevant to your personal data.

11. Data security

11.1 We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

11.2 These measures include use of approved business systems, role-based or need-to-know access, password and authentication controls, controlled sharing and incident-reporting procedures. Core project documents are stored in approved Microsoft 365 environments, including OneDrive and SharePoint, with approved recruitment and assessment systems used where appropriate.

11.3 Staff must not use personal email accounts or unapproved personal devices or consumer file-sharing tools to store or send client or candidate personal data.

12. Retention and deletion

12.1 We keep personal data only for as long as reasonably required for the purpose for which it was collected, taking account of legal obligations, contractual requirements, client instructions, legitimate operational need and the possibility of complaints, audits or legal claims.

12.2 Retention periods therefore vary according to the type of information and the relevant campaign, client arrangement or legal requirement. At the end of the applicable period, personal data will be securely deleted, returned, anonymised or archived as appropriate.

12.3 Where records are required for a complaint, audit, investigation, regulatory matter or legal claim, deletion may be paused until the matter has been resolved.

13. Recruitment opportunities and communications

13.1 Where appropriate, we may contact you about the application you have made and about similar or relevant recruitment opportunities and services.

13.2 Electronic marketing communications are sent in accordance with applicable data protection law and PECR. Where consent is required for a particular communication, we will seek it. Where another lawful basis is available, such as legitimate interests, you may still object to direct marketing or ask us to stop sending recruitment marketing communications at any time.

13.3 Operational communications necessary to administer an active application or respond to a request may continue where we have another lawful basis to send them.

14. Your data protection rights

14.1 Depending on the circumstances and the lawful basis for processing, you may have the right to:

• ask whether we process your personal data and request access to it;
• ask us to correct inaccurate or incomplete personal data;
• ask us to erase personal data in certain circumstances;
• ask us to restrict processing in certain circumstances;
• object to processing based on legitimate interests;
• object at any time to processing for direct marketing purposes;
• request portability of certain personal data where applicable;
• withdraw consent at any time where processing is based on consent;
• request safeguards relating to significant solely automated decisions where applicable; and
• raise a complaint with the Information Commissioner.

Your right to object: Where we rely on legitimate interests, you may object to the processing on grounds relating to your particular situation. You may object to direct marketing at any time. These rights are subject to the conditions and exemptions in applicable law.

14.2 To exercise a right, contact us using the details in section 17. We may need to verify your identity before responding to a request. We will respond within the timescales required by applicable law.

15. Cookies and website information

15.1 Our website may use cookies and similar technologies for purposes such as essential website functionality, security, remembering preferences and measuring website performance or usage.

15.2 We use cookies and similar technologies in accordance with PECR as amended. Where consent is legally required for non-essential cookies, we will seek it through the website cookie controls. Certain limited-purpose cookies may be used without consent where the law permits this and the relevant conditions are met.

15.3 Current information about the cookies in use and available choices should be provided through the website cookie banner or cookie notice. You can also manage cookies through your browser settings, although blocking some cookies may affect website functionality.

16. How we provide this notice

16.1 This notice is made available on the Sanctuary Graduates website. We will also provide or draw attention to it at appropriate points where personal data is collected, for example through registration or application forms, candidate communications, recruitment platforms or assessment processes.

16.2 Where we obtain personal data from another source, we will provide or make this privacy information available within the period required by law, ordinarily within one month, and earlier where required because we first communicate with you or disclose the data to another recipient, subject to any applicable exemption.

17. Our details and how to contact us

17.1 This notice is issued by Sanctuary Search Ltd, trading as Sanctuary Graduates, a company registered in England and Wales under company number 08013693.

17.2 Registered office: The Union Building, 51–59 Rose Lane, Norwich, NR1 1BY.

17.3 Website: www.sanctuarygraduates.co.uk

17.4 General candidate enquiries: students@sanctuarygraduates.co.uk

17.5 Data protection contact: Andrew Neil – andrew.neil@sanctuarygraduates.co.uk

18. Complaints

18.1 If you have concerns about how we process your personal data, or wish to make a data-protection complaint, please contact our data protection contact using the details in section 17.5 so that we can investigate and respond. We will acknowledge a data-protection complaint within 30 days and respond without undue delay in accordance with applicable UK data protection law.

18.2 You also have the right to complain to the Information Commissioner, the UK supervisory authority for data protection. Information about making a complaint is available at www.ico.org.uk.

19. Changes to this notice

19.1 We may update this notice from time to time to reflect changes in law, our services, systems, suppliers or processing activities.

19.2 The latest version will be published on our website. Where a change materially affects how we use personal data, we will take appropriate steps to bring the change to the attention of affected individuals before the new use begins where required.