Workman LLP are committed to protecting and respecting your privacy. Workman are providing you with this Recruitment Privacy Policy because you are applying to work with us. This Privacy Notice (together with any other documents referred to herein) sets out the basis on which the personal data collected from you, or that you provide to us, will be processed by us in connection with our recruitment processes. Please read the following carefully to understand our views and practices regarding your personal data and how We will treat it. If you have any questions, please contact compliance@workman.co.uk.

Workman LLP is a Limited Liability Partnership registered in England with registration number OC327825. The registered office is 80 Cheapside, London EC2V 6EE. In this policy, Workman, we and us means Workman LLP.

This privacy policies applies to Workman who are processing personal data under Data Protection Legislation. For the purpose of the General Data Protection Regulation (“GDPR”) and the United Kingdom General Data Protection Regulation (“UK GDPR”) and the UK Data Protection Act 2018, the Data Controller is Workman LLP.

Workman hold and process a wide range of information, some of which relates to individuals who are applying to work for us. This recruitment policy explains the information we collect from you, why we are processing the data and how it may affect you.

We have a separate Workplace Privacy Policy that applies to our current, former employees and unsuccessful candidates.

We use Workable, an online application provided by Workable Software Limited, to assist with our recruitment process. We use Workable to process personal information as a data processor on our behalf. Workable is only entitled to process your personal data in accordance with our instructions.

Where you apply for a job opening posted by Us, these Privacy Notice provisions will apply to our processing of your personal information in addition to our other Privacy Notice which has been provided to you separately or is available on our Website.

Where you apply for a job opening via the application function on a job site or similar online service provider (“Partner”), you should note that the relevant Partner may retain your personal data and may also collect data from Us in respect of the progress of your application. Any use by the Partner of your data will be in accordance with the Partner’s Privacy Notice.

This Recruitment Privacy Policy explains:

• What personal data we hold and why we process it
• Legal ground for processing personal data
• Where the personal data comes from
• Who gets to see your personal data
• How long we keep your data for
• Your data protection rights
• How to contact us

If we process special category personal data about you (for example (but without limitation), processing your health records to assist us in ensuring that we provide you with reasonable adjustments during any recruitment process), as well as ensuring that one of the grounds for processing mentioned above applies, we will make sure that an additional ground for processing special category personal data applies.

In outline, these include:

• Processing being necessary to comply with employment law, in so far as it is authorised by law or collective agreement;
• Processing relating to data about you that you have made it manifestly public (e.g., if you have told us, you are ill);
• Processing being necessary for the purpose of establishing, making, or defending legal claims;
• Processing being necessary to provide any necessary reasonable adjustments during the recruitment process.

When you apply to work for us the initial personal data about you, if likely to come from you or third-party recruiters, agents and similar organisation. This includes, but is not limited to, contact details, employment history, information on your immigration status and whether you can lawfully work. Please read the recruiters, agents or similar organisations privacy notice for further information on how they collect personal data.

We may also require references and information to carry out background checks. If you have concerns about this, please speak to our HR department.

Workable provides Us with the facility to link the data you provide to Us, with other publicly available information about you that you have published on the Internet – this may include sources such as LinkedIn and other social media profiles.

Workable’ s technology allows Us to search various databases – some publicly available and others not, which may include your personal data (include your CV or Resumé), to find possible candidates to fill our job openings. Where We find you in this way We will obtain your personal data from these sources.

External Use

As set out above, We pass your information to our third-party service providers, including Workable, who use it only in accordance with our instructions and as otherwise required by law.

Where you have applied for a job opening through third party recruiters, agents and similar organisation. Please see the third party recruiters, agents and similar organisation Privacy Notice in respect of the use of the Data that is available on their website.

Where you have applied to a job opening through another service provider, We may disclose data similar to the Disposition Data defined above to such service provider. The service provider shall be the data controller of this data and shall therefore be responsible for complying with all applicable law in respect of the use of that data following its transfer by Us.

Internal Use

Your personal data will be disclosed to managers and HR, for the purpose of considering your application.

Additional disclosure to organisations that process data on our behalf such as our payroll service; insurers and other benefit providers; our bank; organisations that host our IT systems and data; professional service providers such as legal advice. This would normally occur if you accepted an offer from us and would be carried out as part of the on-boarding process.

We also disclose your personal data third party recruitment consultants and similar businesses (including online recruitment portals) as a part of the recruitment process.

We take appropriate measures to ensure that all personal data is kept secure including security measures to prevent personal data from being accidentally lost or used or accessed in an unauthorised way. We limit access to your personal data to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.

We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where We are legally required to do so.

Unfortunately, the transmission of information via the internet is not completely secure. Although We will do our best to protect your personal data, We cannot guarantee the security of your data transmitted through any online means, therefore any transmission remains at your own risk.

Where We store your personal data in our own systems, it is stored UK.

If you would like further information please contact Us (see ‘Contact’ below). We will not otherwise transfer your personal data outside of the United Kingdom or EEA or to any organisation (or subordinate bodies) governed by public international law or which is set up under any agreement between two or more countries.

We will hold all the data for 24 months after we have communicated with you on the outcome of our decision. Your personal data is kept for this period to mitigate potential legal risks related to discrimination claims and to let you know of any further opportunities within Workman, which may arise in the future which we may think would interest you.

After this period Workman will securely delete your personal data in accordance with applicable laws and regulations. We may retain CVs for longer than 24 months, if you have consented us to do so.

If you become employed by us, we will keep your personal data for the duration of your employment and for a fixed period afterwards. Our Data Records Retention and Disposal Policy contains details of the retention period of employment records.

Subject to local data protection laws and in particular under the GDPR and the UK GDPR, you have a number of important rights. These rights are free of charge and within one month of your request, unless the request is complex or is numerous requests. If this is the case, we will inform you within one month of your request about the reason for the extension in time. To exercise these rights please reach out to us using the contact details.

In summary, those include rights to:

• Right to be informed: You have the right to be told how your personal data is and will be used. We will also inform you if your personal data has been involved in a personal data breach which may cause you distress or harm.
• Right of access to your information: You have the right access to your personal data and to certain other supplementary information that this Privacy Notice is already designed to address which relates directly to you. If making such a request, please ensure you include your name and clear instructions on what information you need. It should be noted that if your request is excessive, disproportionate, or repetitive we may ask you to narrow the focus of your request, or we are permitted to decline the request.
• Right of rectification: If you believe that Workman hold incorrect or incomplete records, you have the right for Us to correct any mistakes or enhance your information which We hold
• Right of erasure (right to be forgotten): You have the right to have your personal data deleted. This is only applicable for which we have no lawful basis for retention.
• Opt-Out of marketing communication: You have an absolute right to opt-out of hard copy or electronic marketing communications.
• Withdraw your consent: If we have collected and processed your personal data with your consent, you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent.

For further information on each of those rights, including the circumstances in which they apply, see the Guidance from the UK Information Commissioner’s Office (ICO) on individuals rights under the General Data Protection Regulation.

If you would like to exercise any of those rights, please:

• contact Us using our contact details below,
• let Us have enough information to identify you,
• let Us have proof of your identity and address, and
• let Us know the information to which your request relates.

We hope that We can resolve any query or concern you raise about Our use of your information.

The General Data Protection Regulation and the UK GDPR also give you right to lodge a complaint with a supervisory authority, in particular (under the GDPR) in the European Union (or European Economic Area) state where you work, normally live or where any alleged infringement of data protection laws occurred.

All questions, comments and requests regarding this Privacy Notice should be addressed to data.protection@workman.co.uk

This Recruitment Privacy Policy does not form part of any contract of employment you might enter into and does not create contractual rights or obligations. It may be amended by us at any time.

We keep our privacy policy under regular review and reserve the right to revise it at any time. There is a date at the beginning of this policy which indicates the date it was updated. Please revisit this policy each time you consider giving personal information.

‘Data Protection Legislation’ means all applicable data protection and privacy legislation in force from time to time and applying to either party or their activities hereunder, including: (a) the General Data Protection Regulation ((EU) 2016/679) as it forms part of domestic law in the United Kingdom by virtue of section 3 of the European Union (Withdrawal) Act 2018 (including as further amended or modified by the laws of the United Kingdom or a part of the United Kingdom from time to time

‘Personal data’ means any information relating to an identified or identifiable natural; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person

‘Processing’ means any action performed on personal data, from collection and storage to deletion.

‘Special Category Personal Data’ means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, physical or mental health, sexual orientation, sex life, trade union membership and genetic and biometric data. These types of data are subject to special protection under the law. In the UK this also includes actual and alleged criminal convictions.

‘You’ this word is used as it refers to anyone within scope of the Recruitment Privacy Notice.

This policy was last updated on the 23rd September 2025