Legal
Candidate Privacy Notice
How we collect, use, store and share your personal data when you apply or use our careers site.
1. About this notice
This notice explains how Rana Group Ltd and the companies within the Rana Group ("Rana Group", "we", "us", "our") collect, use, store and share your personal data when you:
- apply for a role with us, whether online, in person, by email, or through a third party;
- register your interest in working with us, join our talent pool, or sign up for job alerts;
- are put forward to us by a recruitment agency, a job board, or an existing colleague;
- attend an interview, assessment, trial shift or open day; or
- otherwise interact with our careers website or recruitment team.
We are committed to protecting your privacy and handling your data in an open and transparent way. This notice is provided under Articles 13 and 14 of the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018 ("DPA 2018").
This notice does not form part of any contract of employment or offer of employment. We may update it at any time — see section 17.
If you are offered and accept a role with us, a separate Employee Privacy Notice will apply from the point your employment begins. This notice will continue to apply to the data we collected during your application.
2. Who is the data controller?
Rana Group Ltd is the data controller for personal data processed through our recruitment activity.
You can contact us about anything in this notice, or to exercise your rights, at:
- Email: Email us
- Post: Data Protection, Rana Group Ltd (registered office address available on request via email)
2.1 Group companies
Rana Group operates through a number of separate legal entities, each of which owns and operates one or more of our sites and stores. Where your application relates to a role at one of these sites, the company operating that site and Rana Group Ltd act as joint controllers in respect of your recruitment data.
Rana Group Ltd takes the lead on operating the careers site and applicant tracking system, responding to requests from candidates to exercise their rights, and setting retention periods and security standards. You may exercise your rights against any of the joint controllers, but contacting us at the address above is the quickest route.
Details of the specific company acting as controller in relation to your application, and of our joint controller arrangement, are available on request.
3. The personal data we collect
We collect the following categories of personal data about you. Not all of it will apply to every application — the data we collect depends on the role and the stage you reach.
3.1 Information you give us
Identity and contact data
- Full name, any previous names, and preferred name
- Postal address
- Personal email address
- Telephone and mobile numbers
- Date of birth (where required to confirm you meet the minimum age for a role, for example roles involving the sale of alcohol, tobacco, knives or lottery products)
Application data
- Your CV and covering letter
- Employment history, including job titles, employers, dates and reasons for leaving
- Education, qualifications, training and professional memberships
- Skills, competencies and licences (for example a personal licence, food hygiene certification, or a driving licence)
- Answers to application form questions and any screening questions
- Your right-to-work status and whether you require sponsorship
- Your notice period, availability, and preferred working hours or shift patterns
- Your salary expectations
- Whether you are related to, or have a personal relationship with, any existing Rana Group colleague
- Whether you have previously worked for or applied to any Rana Group company
- Locations, stores or brands you are willing to work at, and your willingness to travel
- Any other information you choose to include in your application or share with us during the process
Assessment data
- Interview notes, scores and feedback
- Results of any tests, exercises, trial shifts or assessment centres
- Notes of any calls or correspondence with our recruitment team
- Reasons for our decision at each stage
Offer stage data (collected only if we make you an offer)
- Right-to-work documentation, such as a passport, biometric residence permit, share code or birth certificate
- Details of any licences or certifications required for the role
We do not collect payroll, bank, pension or emergency contact details as part of the recruitment process. If you accept an offer, that information is collected separately once your employment begins and is covered by our Employee Privacy Notice.
3.2 Information we receive from others
- Recruitment agencies and job boards — your CV, contact details and any notes they provide
- Referees — references covering your employment history, performance, conduct and suitability, requested only at offer stage and only with your permission
- Existing Rana Group colleagues — where you are referred through our employee referral scheme
We do not use external screening, background check, credit reference or data enrichment providers as part of our recruitment process, and we do not build profiles of candidates from publicly available sources.
3.3 Technical data (careers website)
When you use careers.ranagroup.co.uk we collect:
- IP address and approximate location
- Browser type and version, device type and operating system
- Pages visited, time spent, referral source and search terms
- Login and account data if you create a candidate account
See Cookie policy below for details of cookies and similar technologies, and how to manage them.
4. Special category and criminal offence data
4.1 Special category data
Some personal data is treated as "special category" data under Article 9 UK GDPR and requires additional protection. We may process:
Equal opportunities monitoring data — including your racial or ethnic origin, religion or belief, sexual orientation, gender identity, and disability status. Providing this is entirely voluntary. It is separated from your application, is not visible to hiring managers, is not used in any recruitment decision, and is used only in aggregated, anonymised form to monitor and improve the diversity of our workforce.
Health data — where you tell us about a disability or health condition so that we can consider reasonable adjustments to the recruitment process or to the role itself. We do not carry out pre-employment health screening as part of the recruitment process.
Our lawful bases for processing special category data are:
- Article 9(2)(b) UK GDPR together with Schedule 1, Part 1, paragraph 1 DPA 2018 — processing necessary for carrying out our obligations in the field of employment law, including our duty to make reasonable adjustments under the Equality Act 2010;
- Article 9(2)(b) UK GDPR together with Schedule 1, Part 2, paragraph 8 DPA 2018 — processing for the purposes of identifying or reviewing the existence or absence of equality of opportunity or treatment between groups of people;
- Article 9(2)(a) UK GDPR — your explicit consent, where we rely on it and have told you so.
We maintain an Appropriate Policy Document as required by Schedule 1 DPA 2018, available on request.
4.2 Criminal offence data
We do not process criminal offence data as part of our recruitment process, and we do not ask candidates to disclose convictions or carry out criminal record checks at application stage.
Where a specific role is legally required to be filled by someone holding a particular licence or clearance, we will tell you at the point of offer and explain separately what that involves.
5. Why we use your data and our lawful basis
| # | Purpose | Lawful basis |
|---|---|---|
| 1 | Receiving, acknowledging and administering your application | Legitimate interests — running an effective recruitment process; Steps prior to entering a contract (Art. 6(1)(b)) |
| 2 | Assessing your skills, qualifications and suitability for the role | Legitimate interests; Steps prior to entering a contract |
| 3 | Communicating with you about your application, interviews and outcomes | Legitimate interests; Steps prior to entering a contract |
| 4 | Verifying the information you have provided, including references | Legitimate interests — ensuring accuracy and protecting our business |
| 5 | Checking your right to work in the UK | Legal obligation (Immigration, Asylum and Nationality Act 2006) |
| 6 | Considering and making reasonable adjustments | Legal obligation (Equality Act 2010); Art. 9(2)(b) for health data |
| 7 | Equal opportunities monitoring | Legitimate interests; Schedule 1 Part 2 para 8 DPA 2018 |
| 8 | Sharing your application with other companies in the Rana Group for roles you have applied for | Legitimate interests — operating recruitment efficiently across the group (see section 6) |
| 9 | Considering you for other roles and other stores across the Rana Group where we think you may be a suitable candidate | Legitimate interests — matching candidates to suitable opportunities; you may object at any time (see section 6) |
| 10 | Keeping your details on file in our talent pool for future vacancies | Consent, or Legitimate interests where you have applied within the last 12 months |
| 11 | Making an offer, and onboarding you if you accept | Steps prior to entering a contract; Legal obligation |
| 12 | Defending or responding to legal claims, including discrimination claims and Employment Tribunal proceedings | Legitimate interests — establishing, exercising or defending legal claims; Legal obligation |
| 13 | Preventing and detecting fraud, dishonesty and misrepresentation in applications | Legitimate interests — protecting our business, colleagues and customers |
| 14 | Maintaining the security, integrity and performance of our careers website and IT systems | Legitimate interests — network and information security |
| 15 | Analysing and improving our recruitment process, including source-of-hire and drop-off analysis | Legitimate interests — improving our services (data used in aggregate wherever possible) |
Where we rely on legitimate interests, we have carried out a balancing assessment to confirm our interests are not overridden by your rights and freedoms. You can request a summary of this assessment by contacting us.
Where we rely on consent, you can withdraw it at any time. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal, and does not affect processing carried out on another lawful basis.
6. Sharing your data within the Rana Group
This section is important — please read it carefully.
Rana Group operates a large number of stores and sites across multiple brands, trading through several group companies. Recruitment is coordinated centrally so that candidates can be matched to the widest possible range of opportunities.
6.1 Sharing for the role you applied for
Your application will be shared with the group company that operates the site you applied to, and with the relevant managers, area managers and HR colleagues involved in that hiring decision. It will also be accessible to our central recruitment and HR team.
6.2 Sharing across the wider group and other stores
Unless you tell us otherwise, we will also make your application available to hiring managers at other stores, sites and group companies within the Rana Group where we consider you may be a suitable candidate for a current or upcoming vacancy. This means, for example, that:
- if you apply to one of our stores and are not successful there, a nearby store with a vacancy may contact you about it;
- if you apply for one role, we may consider you for a different role we think fits your skills and experience better;
- your details may be visible to recruiting managers at other Rana Group brands.
What we share for this purpose: your name, contact details, CV, application form, stated availability and location preferences, and the outcome and general feedback from any assessment you have completed. We do not share equal opportunities monitoring data or health data for this purpose.
Our lawful basis for this is legitimate interests — we believe it benefits both you and us to consider you for the widest range of suitable opportunities rather than requiring you to make a separate application to each site.
Your right to object. You can ask us to limit your application to the specific role and site you applied for at any time, and we will action this. Email Email us with the subject line "Restrict my application". This will not affect the consideration of your original application.
6.3 Third parties outside the group
We may also share your personal data with:
| Recipient | Purpose | Role |
|---|---|---|
| Applicant tracking / careers platform providers | Hosting and managing applications | Processor |
| IT, hosting and cloud providers | Hosting our careers site and systems | Processor |
| Recruitment agencies | Sourcing and managing candidates | Controller / Processor |
| Job boards and advertising platforms | Advertising vacancies and receiving applications | Independent controller |
| Referees and previous employers | Obtaining and verifying references, at offer stage only and with your permission | Independent controller |
| Professional advisers — lawyers, auditors, insurers | Legal advice, audit and insurance | Independent controller |
| Regulators and law enforcement — including HMRC, the Home Office, the ICO and the police | Where required by law or to prevent or detect crime | Independent controller |
| A purchaser or prospective purchaser of all or part of our business | In connection with a sale, merger, restructure or acquisition | Independent controller |
Where we use processors, they act only on our documented instructions under a written contract that meets the requirements of Article 28 UK GDPR.
We do not share your data with background screening providers, credit reference agencies, occupational health providers, or payroll and pension providers during the recruitment process.
We do not sell your personal data, and we do not share it with third parties for their own marketing purposes.
7. International transfers
Our recruitment data is primarily stored within the UK and the European Economic Area (EEA).
Where any of our providers process data outside the UK, we ensure an appropriate safeguard is in place, being one of the following:
- the country is covered by UK adequacy regulations;
- an International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses is in place; or
- another safeguard permitted under Chapter V UK GDPR applies.
We carry out a Transfer Risk Assessment where required. You can request details of the safeguards applying to any specific transfer by contacting us.
8. How long we keep your data
| Data | Retention period |
|---|---|
| Unsuccessful applications (all data) | 6 months from the date we notify you of the outcome |
| Talent pool records, where you have consented | 12 months from the date of your consent or last contact, then deleted unless you renew |
| Interview notes and assessment records for unsuccessful candidates | 6 months from the outcome date |
| Equal opportunities monitoring data | Anonymised and aggregated within 6 months; aggregated statistics retained indefinitely |
| Right-to-work documentation, where an offer was made but not taken up | Deleted once the outcome is confirmed |
| Successful candidates | Transferred to your employee file and retained under our Employee Privacy Notice and retention schedule |
| Records relating to an actual or threatened legal claim | Until the claim is finally resolved plus 6 years |
| Careers website analytics | 26 months |
Our retention periods for unsuccessful candidates reflect the time limits for bringing a discrimination claim under the Equality Act 2010 and allow us to respond to any complaint or claim.
At the end of the retention period we will securely delete or irreversibly anonymise your data.
9. Automated decision-making and profiling
We do not make decisions about candidates using solely automated means, and we do not carry out profiling that produces legal or similarly significant effects. Our systems may sort or organise applications to help our team prioritise their review, but every decision to progress or reject an application is made by a person.
10. Providing your data — is it required?
You are not under a statutory or contractual obligation to provide us with your personal data. However, if you do not provide the information we ask for as part of the application process, we may not be able to process your application properly or at all.
If you are offered a role, we are legally required to verify your right to work in the UK (or the relevant country for the role). If you do not provide this evidence, we will not be able to employ you.
Equal opportunities monitoring data and information about a disability or health condition are always voluntary.
11. Your rights
Under UK data protection law you have the following rights, free of charge:
- Right of access — to obtain a copy of the personal data we hold about you, together with information about how we process it.
- Right to rectification — to have inaccurate personal data corrected, and incomplete data completed.
- Right to erasure — to have your personal data deleted in certain circumstances, for example where it is no longer necessary for the purpose we collected it.
- Right to restriction — to ask us to limit how we use your data in certain circumstances.
- Right to object — to object to processing based on our legitimate interests, including the sharing described in section 6.2. We will stop unless we can show compelling legitimate grounds that override your interests.
- Right to data portability — to receive personal data you provided to us in a structured, commonly used and machine-readable format, where processing is based on consent or contract and carried out by automated means.
- Right to withdraw consent — where we rely on consent, at any time.
- Rights in relation to automated decision-making — to obtain human intervention, express your view and contest a decision made solely by automated means with legal or similarly significant effects.
How to exercise your rights
Contact Email us or write to Data Protection, Rana Group Ltd (registered office address available on request).
We will respond within one month. We may extend this by up to two further months for complex or numerous requests, and will tell you within the first month if we do. We may need to verify your identity before acting on a request.
12. How to complain
If you are unhappy with how we have handled your personal data, please contact us first at Email us so that we have the opportunity to put things right.
You also have the right to complain to the UK supervisory authority:
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113
Website: ico.org.uk/make-a-complaint
You do not need to complain to us first, but we would appreciate the chance to resolve your concerns.
13. How we keep your data secure
We have implemented appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing, accidental loss, destruction or damage, including:
- role-based access controls, so that recruitment data is accessible only to colleagues who need it;
- encryption of data in transit and at rest;
- multi-factor authentication on our applicant tracking and HR systems;
- written contracts with all processors containing Article 28 obligations;
- staff training on data protection for everyone involved in recruitment;
- secure destruction of physical documents and secure deletion of electronic records;
- a documented personal data breach procedure, under which we will notify the ICO within 72 hours where required and notify you where a breach is likely to result in a high risk to your rights and freedoms.
14. Recruitment fraud warning
We will never ask you to pay a fee at any stage of our recruitment process, and we will never ask for bank details other than for payroll set-up after you have accepted a written offer.
All genuine Rana Group vacancies are advertised at careers.ranagroup.co.uk, and our recruiters will contact you from an @ranagroup.co.uk email address. If you receive a suspicious communication claiming to be from us, please report it to Email us and to Action Fraud at actionfraud.police.uk.
15. Candidates under 18
We recruit candidates aged 16 and over for certain roles, subject to legal restrictions on the sale of age-restricted products and on working hours for young workers.
Where a candidate is under 18, we will only collect the data necessary for the application and, where required, will seek the involvement of a parent or guardian. We do not knowingly collect personal data from anyone under 16 through our careers site.
16. Third-party links
Our careers site may contain links to third-party websites, plug-ins and applications, including job boards and social media platforms. Clicking those links may allow third parties to collect or share data about you. We do not control these third-party sites and are not responsible for their privacy practices. Please read the privacy notice of every site you visit.
Cookie policy
Our careers site may use essential cookies required for the site to function, and limited analytics cookies to understand how the site is used so we can improve it. Where non-essential cookies are used, we will ask for your consent where required by law.
You can control cookies through your browser settings. Blocking some cookies may affect site functionality. For more detail about cookies generally, see the ICO guidance on cookies.
17. Changes to this notice
We keep this notice under review and may update it from time to time to reflect changes in how we process personal data or in the law.
The current version will always be available at careers.ranagroup.co.uk/privacy. Where changes are significant, we will take reasonable steps to notify candidates with a live application. The "Last updated" date at the top of this notice shows when it was last revised.
18. Contact us
- Email: Email us
- Careers enquiries: Email us
- Post: Data Protection, Rana Group Ltd (registered office address available on request via email)