Privacy policy for the Charcoalblue employer branding and recruitment
Date of publication: 22-04-2026
We at Charcoalblue Group Ltd manage our employer branding and recruitment process through our career site (the “Career Site”), and by using a related applicant tracking system.
In this privacy policy, we explain how we process your personal data if:
- You visit our Career Site (you being a “Visitor”)
- You connect with us via our Career Site, to create a profile with us and receive information about current or future vacancies with us (you being a “Connecting Candidate”)
- You apply for a position with us, via our Career Site or a third party service (you being an ”Applying Candidate”)
- We collect information about you from other parties, sites and services, since we believe your profile is of interest for our current or future vacancies (you being a “Sourced Candidate”)
- We receive information about you from our employees or partners, since they believe your profile is of interest for our current or future vacancies (you being a “Referred Candidate”)
- We receive information about you from a Candidate, who lists you as their reference (you being a “Reference”).
This privacy policy also describes what rights you have when we process your personal data, and how you can exercise these rights.
When we use the term “Candidate” in this privacy policy, we are referring to each of Connecting Candidates; Applying Candidates; Sourced Candidates; and Referred Candidates, unless it’s stated otherwise.
1. About processing of personal data
Personal data is all information that can be directly or indirectly linked to a living individual. Examples of personal data are: name, e-mail address, telephone number and IP address. Processing of personal data is any automated use of personal data - such as collecting, creating, analyzing, sharing, and deleting personal data.
There are laws and regulations on how companies may process personal data, so-called data protection laws. Different data protection laws apply to different types of use of personal data, and in different parts of the world. An example of a data protection law that is relevant for our use of your personal data, as described in this privacy policy, is the EU Data Protection Regulation (2016/679, “GDPR”).
Most obligations under the GDPR apply to the so-called data controller. A data controller is the entity that decides for which purposes personal data will be processed, and how the processing will be executed. The data controller can use a so-called data processor. A data processor is an entity that is only allowed to process personal data as instructed by the data controller, and may not use the personal data for its own purposes.
Charcoalblue Group Ltd (“we”, “us”, or “our”) is the data controller responsible for the processing of your personal data described in this Privacy Policy.
Company details:
-
Registered name: Charcoalblue Group Ltd
-
Company number: 17025121
-
Registered office: 17 Short Street, London, SE1 8LJ
As the data controller, we are responsible for deciding how and why your personal data is processed, in accordance with the UK GDPR and the Data Protection Act 2018.
Contact details
If you have any questions about this Privacy Policy or how we handle your personal data, you can contact us at:
Data protection contact
We have not appointed a Data Protection Officer (DPO). However, if you have any queries about data protection, you can contact us using the details above.
2. What personal data do we process?
All individuals
- Device information - If you visit our Career Site, we will collect information about your device, such as IP address, browser type and version, session behaviour, traffic source, screen resolution, preferred language, geographic location, operating system and device settings/usage.
- Technical and statistical data - If you visit our Career Site, we will collect technical and statistical data about your use of the site, such as information about which URLs you visit, and your activity on the site.
- Communications data - We will collect and store your communication with us, including the information you provided in the communication. This may include the content of emails, video recordings, messages on social media, the information you add to your account with us, surveys, etc.
- Contact details - Such as your name, email address, telephone number and physical address.
Candidates
- Data from interviews, assessments and other information from the recruitment process - Such as notes from interviews with you, assessments and tests made, salary requirements.
- Information in your application - Such as your CV, cover letter, work samples, references, letters of recommendation and education.
- Information in your public profile - Meaning the information we collect about you from public sources related to your professional experience, such as LinkedIn or the website of your current employer.
- Information provided by references - Meaning the information we receive from our employees or partners who refer you to us, or by the persons you have listed as your references.
3. Where do we receive your personal data from?
All individuals
- From the Career Site. If you visit our Career Site, we collect technical and statistical information about how you use the Career Site, and information from your device.
- Directly from you. Most of the information we process about you, we receive directly from you, for example when you apply for a position with us or connect with us. You can always choose not to provide us with certain information. However, some personal data is necessary in order for us to process your application or provide you the information you request to get from us.
References
- From the person for whom you are a reference. If a Candidate lists you as their reference, we will collect your contact details from the candidate to be able to contact you.
Candidates
- From public sources. We may collect personal data about you from public sources, such as LinkedIn or the website of your current employer. Where we collect your personal data from public sources, we will provide you with this privacy information within one month of obtaining your data, or at the time of first contact.
- From our references. We may receive information about you from our employees or partners (such as recruitment service providers), when they believe your profile is of interest for our current or future vacancies.
- From your references. If you provide us with references, we may collect information about you from them.
- Data we create ourselves or in cooperation with you. Information about your application and profile is usually created by us, or by us in cooperation with you, during the recruitment process. This may for example include notes from interviews with you, assessments and tests made.
- Our recruitment services are not intended for individuals under 16, and we do not knowingly collect personal data from children.
4. For what purposes do we process your personal data?
Protect and enforce our rights, interests and the interests of others, for example in connection with legal claims.
Affected individuals: The individual(s) affected by the legal issue - this may include persons from all categories of individuals listed above.
Categories of personal data used: All the categories of personal data listed above can be used for this purpose.
Share your personal data with other recipients, for the purposes mentioned in Section 5 below.
Affected individuals: Varies depending on the purpose of the sharing, see Section 5 below.
Categories of personal data used: All the categories of personal data listed above may be used for this purpose.
Collect information about your use of the career site, using cookies and other tracking technologies, as described in our Cookie Policy.
We will obtain your consent before placing non-essential cookies on your device.
Affected individuals: Visitors.
Categories of personal data used: Device information.
Maintain, develop, test, and otherwise ensure the security of the career site.
Affected individuals: Visitors.
Categories of personal data used: Device information; Technical and statistical data.
Analyse how the career site and its content is being used and is performing, to get statistics and to improve operational performance.
Affected individuals: Visitors.
Categories of personal data used: Device information; Technical and statistical data.
Provide you with updates about vacancies with us.
Affected individuals: Connecting Candidates.
Categories of personal data used: Contact details; Communications data.
Review profiles and applications sent to us. This also includes communicating with you about your application and profile.
Affected individuals: Connecting Candidates; Applying Candidates.
Categories of personal data used: All the categories of personal data listed above may be used for this purpose.
Collect and evaluate your professional profile on our own initiative. This also includes communicating with you regarding your profile.
Affected individuals: Sourced Candidates; Referred Candidates.
Categories of personal data used: All the categories of personal data listed above may be used for this purpose.
Contact you directly about specific, future vacancies with us.
Affected individuals: Candidates.
Categories of personal data used: All the categories of personal data listed above may be used for this purpose.
Record the interview(s) with you.
Affected individuals: Candidates.
Categories of personal data used: Communications data.
Contact you to ask for your participation in surveys
Affected individuals: Candidates.
Categories of personal data used: All the categories of personal data listed above may be used for this purpose.
Contact you to ask you to provide information about a candidate, and evaluate the information you provide.
Affected individuals: References.
Categories of personal data used: Contact details; Communications data.
5. Whom do we share your personal data with?
Our service providers. We share your personal data with our suppliers who provide services and functionality in our employer branding- and recruitment process. For example, this includes recruitment service providers and the supplier of our Career Site and related applicant tracking system.
Our group companies. We share your personal data with our group companies, when they provide us services and functionality to our employer branding- and recruitment process, such as access to particular systems and software.
Companies providing cookies on the Career Site. If you consent to it, cookies are set by other companies than us, who will use the data collected by these cookies in accordance with their own privacy policy. You can find information about which cookies this applies to in our Cookie Policy.
To authorities and other public actors - when we are ordered to do so. We will share your personal data with authorities and other public actors when we have a legal obligation to do so.
To parties involved in legal proceedings. If needed to protect or defend our rights, we share your personal data with public authorities or with other parties involved in a potential or existing legal proceeding. This can for example be in case of discrimination claims.
Mergers and acquisitions etc. In connection with a potential merger, sale of company assets, financing, or acquisition of all or part of our business to another company, we may share your personal data to other parties involved in the process.
6. On what legal bases do we process your personal data?
To process your personal data lawfully, we rely on one or
more of the legal bases set out in the UK GDPR. The legal basis we rely on
depends on the specific purpose for which your personal data is processed.
Recruitment and application management
Purpose: Reviewing applications, assessing
candidates, communicating with you, and making hiring decisions
Legal basis: Legitimate interests
We have a legitimate interest in recruiting suitable
employees and managing our recruitment processes. We consider this use of your
personal data to be necessary and proportionate, and not overridden by your
rights and interests.
Candidate sourcing and talent pooling
Purpose: Identifying potential candidates,
contacting you about roles, and considering you for future opportunities
Legal basis: Legitimate interests
We have a legitimate interest in identifying and engaging
potential candidates for current and future roles. You have the right to object
to this processing at any time.
We only use publicly available professional information and ensure our processing does not override your rights and expectations.
Communication about vacancies (email alerts / updates)
Purpose: Sending you information about job opportunities and updates
Legal basis:
Consent (where required), or
Legitimate interests (where permitted under applicable law)
Where required, we will obtain your consent before sending such communications. You can opt out at any time.
Interview recording
Purpose: Recording interviews for evaluation and
internal review
Legal basis: Consent
We will always ask for your consent before recording any
interview. You can withdraw your consent at any time. Please note, we do not normally record any interviews.
Reference checks
Purpose: Verifying your experience and suitability
for a role
Legal basis: Legitimate interests
We have a legitimate interest in verifying candidate
information as part of our recruitment process.
Website functionality, security, and analytics
Purpose: Maintaining, securing, and improving the Career Site
Legal basis:
Legitimate interests (for essential functionality and security)
Consent (for non-essential cookies and tracking technologies)
Legal claims and compliance
Purpose: Protecting our legal rights and complying with legal obligations
Legal basis:
Legal obligation, or
Legitimate interests
Data sharing within group and with service providers
Purpose: Operating recruitment systems and processes
Legal basis: Legitimate interests
You can request more information about our legitimate
interest assessments by contacting us (see Section 10).
We do not make solely automated decisions that have legal or similarly significant effects on you.
7. International transfers of your personal data
We primarily store and process your personal data within the United Kingdom (UK) and the European Economic Area (EEA).
However, in some cases, your personal data may be transferred to, or accessed from, countries outside the UK.
When do we transfer your data outside the UK?
This may happen where:
-
We use service providers (such as recruitment platforms or IT providers) based outside the UK
-
Our group companies or partners operate outside the UK
-
Data is accessed remotely from outside the UK
How do we protect your data?
Whenever we transfer personal data outside the UK, we ensure that appropriate safeguards are in place, as required by UK data protection law.
These safeguards include:
Adequacy regulations
Where the UK government has determined that a country provides an adequate level of data protection, we may transfer your personal data to that country.
International Data Transfer Agreement (IDTA) or UK Addendum
Where a country is not considered adequate, we use:
-
the UK International Data Transfer Agreement (IDTA), or
-
the UK Addendum to the EU Standard Contractual Clauses
These are legally binding contracts that ensure your personal data is protected to UK standards.
Additional safeguards
Where necessary, we also implement supplementary measures, such as:
-
encryption
-
access controls
-
data minimisation
to ensure your personal data remains secure.
Transfers to the United States
Where we transfer personal data to organisations in the United States, we may rely on the UK Extension to the EU-US Data Privacy Framework, where applicable.
Your rights
You have the right to request further information about the safeguards we use when transferring your personal data outside the UK.
You can contact us using the details in Section 10.
8. For how long do we keep your personal data?
We only retain your personal data for as long as necessary for the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements.
Visitors
Device and usage data: up to 12 months
for security and analytics purposes
Cookie data: As specified in our Cookie Policy
Candidates
Applicants (unsuccessful)
Personal data relating to your application: up to 12 months after the recruitment process ends
This allows us to:
Consider you for future roles
Respond to legal claims (e.g. discrimination claims)
Applicants (successful)
Your data will be retained as part of your employee record and processed in accordance with our employee privacy policy
Talent pool / Connecting Candidates / Sourced Candidates
Personal data: up to 12 months from last meaningful interaction
Examples of interaction include:
Updating your profile
Opening or responding to communications
Engaging with recruitment processes
If no interaction occurs within this period, your data will be deleted or anonymised. You can request removal from our talent pool at any time.
Interview recordings
Recordings: deleted within 3 months after the recruitment process ends, unless you consent to a longer retention period
References
Reference data: retained for up to 12 months after the relevant recruitment process ends
Legal claims
Where data is required for legal purposes: retained for up to 6 years after the relevant event, in line with UK limitation periods
9. What rights do you have, and how can you exercise them?
In this section, you will find information about the rights you have when we process your personal data. As described below, some of the rights only come into play when we process your personal data under a particular legal basis.
If you want to exercise any of the rights listed here, we suggest that you:
- Visit the Data & Privacy page on our Career Site, where we offer features to let you exercise your rights;
- Log in to your account with us, where you can use the settings in the account to exercise your rights; or
- Contact us directly at jake.katz@charcoalblue.com.
Right to be informed
You have the right to be informed about how we process your personal data. You also have the right to be informed if we plan to process your personal data for any purpose other than that for which it was originally collected.
We provide you with such information through this privacy policy, through updates on our Career Site (see also Section 11 below), and by answering any questions you may have for us.
Right to access your personal data.
You have the right to know if we process personal data about you, and to receive a copy of the data we process about you. In connection with receiving the copy of your data, you will also receive information about how we process your personal data.
Right to access and to request a transfer of your personal data to another recipient (“data portability”).
You can request a copy of the personal data relating to you that we process for the performance of a contract with you, or based on your consent, in a structured, commonly used, machine-readable format. This will allow you to use this data somewhere else, for example to transfer it to another recipient. If technically feasible, you also have the right to request that we transfer your data directly to another recipient.
Right to have your personal data deleted (“right to be forgotten”).
In some cases, you have the right to have us delete personal data about you. This is for example the case if it’s no longer necessary for us to process the data for the purpose for which we collected it; if you withdraw your consent; if you have objected to the processing and there are no legitimate, overriding justifications for the processing. (For the separate right to object, see below.)
Right to object against our processing of your personal data.
You have the right to object at any time to the processing of your personal data for direct marketing purposes. If you object, we will stop such processing immediately.
Right to restrict processing.
If you believe that the personal data we process about you is inaccurate, that our processing is unlawful, or that we don’t need the information for a specific purpose, you have the right to request that we restrict the processing of such personal data. If you object to our processing, as described just above, you can also request us to restrict processing of that personal data while we make our assessment of your request.
When our processing of your personal data is restricted, we will (with the exception of storage) only process the data with your consent or for the establishment, exercise or defence of legal claims, to protect the rights of another natural or legal person, or for reasons relating to an important public interest.
Right to rectification.
You have the right to request that we rectify inaccurate information, and that we complete information about you that you consider incomplete.
Right to withdraw your consent.
When we process your personal data based on your consent, you have the right to withdraw that consent at any time. If you do so, we will stop processing your data for the purposes you’ve withdrawn your consent for. However, it doesn’t affect the lawfulness of processing that was based on your consent before it was withdrawn.
Right to raise a complaint.
If you have complaints about our processing of your personal data, you can raise a complaint with the data protection authority in United Kingdom. You can find their contact details here.
You can also lodge a complaint with your national data protection authority, which you can find listed here if you are based in the EU. If you are based in the UK, you can lodge a complaint with the Information Commissioner’s Office, here.
10. Where can you turn with comments or questions?
If you want to get in touch with us to exercise your rights, or if you have any questions, comments or concerns about how we handle your personal data, you can reach us by sending an email to jake.katz@charcoalblue.com.
11. Updates to this Privacy policy
We update this privacy policy when necessary - for example, because we start processing your personal data in a new way, because we want to make the information even clearer to you, or if it’s necessary to do so in order to comply with applicable data protection laws.
We encourage you to regularly check this page for any changes. You can always check the top of this page to see when this privacy policy was last updated.
