top of page

SRA Recruitment Privacy Notice

1. Introduction

Southside Rehabilitation Association Ltd (“SRA”, “we”, “us”) is committed to protecting the privacy and security of your personal information throughout the recruitment process. This notice explains how we collect, use, store, and share your data when you apply for a role with us, whether as an employee, worker, contractor, volunteer, or placement student.

This notice applies to all applicants, whether you apply directly or through a recruitment agency.

2. Who We Are

Data Controller: Southside Rehabilitation Association Ltd 45 Knights Hill West Norwood London SE27 0HS

Contact for data protection queries: Email: office@sra-ltd.co.uk Telephone: 020 8766 6688

3. What Personal Data We Collect

3.1 Personal identification and contact details

  • Name, address, telephone number, email

  • Date of birth (where required)

  • Right‑to‑work documentation

3.2 Application and employment history

  • CV, application form, cover letter

  • Qualifications, training records, professional memberships

  • Employment history and skills

  • Interview notes and assessment results

3.3 References

  • Information provided by referees

  • Verification of employment, conduct, and performance

3.4 Criminal‑offence data (Enhanced DBS checks)

Because SRA works with vulnerable adults and young people, all staff, volunteers, placement students and contractors are required to undergo an Enhanced DBS check, with or without barred‑list checks depending on the role.

We do not keep copies of DBS certificates. We record only:

  • the certificate number

  • the date of issue

  • whether any information was disclosed

  • the outcome of our suitability decision

Where a certificate is temporarily viewed or copied for verification, any copy is destroyed within 6 months, in line with the DBS Code of Practice.

We process criminal‑offence data under Article 10 UK GDPR and relevant safeguarding legislation.

3.5 Special category data

Where relevant to the role or required by law, we may process:

  • Health information (e.g., fitness for work, reasonable adjustments)

  • Occupational health assessments

  • Equality and diversity monitoring data (ethnicity, disability, gender, etc.)

Processed under Article 9(2)(b), 9(2)(h) and substantial public interest safeguarding grounds.

3.6 IT and systems data

  • Email correspondence

  • Information submitted via Microsoft 365, recruitment portals, or online forms

4. How We Collect Your Information

We collect information from:

  • You directly (application forms, CVs, interviews)

  • Recruitment agencies

  • Referees

  • DBS checking provider

  • Occupational health provider

  • Right‑to‑work checks (Home Office)

5. Why We Use Your Personal Data

We process your data to:

  • Assess your suitability for the role

  • Communicate with you during the recruitment process

  • Verify information you have provided

  • Conduct right‑to‑work and safeguarding checks

  • Carry out Enhanced DBS checks

  • Make reasonable adjustments for disability

  • Maintain recruitment records and comply with audit requirements

We do not use your data for marketing.

6. Lawful Basis for Processing

Article 6 UK GDPR

  • 6(1)(b) – steps prior to entering a contract

  • 6(1)(c) – legal obligations (right‑to‑work, safeguarding)

  • 6(1)(f) – legitimate interests (managing recruitment, ensuring safe staffing)

Article 9 UK GDPR (Special Category Data)

  • 9(2)(b) – employment and social protection law

  • 9(2)(h) – occupational health

  • 9(2)(g) – substantial public interest (safeguarding)

Article 10 UK GDPR (Criminal‑offence Data)

Processed under the DBS Code of Practice and safeguarding legislation.

7. Who We Share Your Data With

We may share your information with:

  • Referees

  • DBS checking provider

  • Occupational health provider

  • HR/payroll provider

  • Our IT provider (Jaytag)

  • Regulators where legally required

  • Recruitment agencies (if applicable)

We do not sell or share your data for marketing.

8. International Transfers

Some of our systems (e.g., Microsoft 365, cloud storage) may transfer data outside the UK. Where this occurs, transfers are protected by:

  • UK Addendum to the EU Standard Contractual Clauses

  • Adequacy regulations

  • Additional safeguards required by UK GDPR

9. How Long We Keep Recruitment Data

  • Unsuccessful applicants: retained for 12 months after the recruitment decision

  • Successful applicants: data becomes part of the personnel file

  • DBS certificate information: retained only as described above

  • Equality monitoring data: anonymised as soon as possible

We retain data only for as long as necessary for recruitment, safeguarding, audit, and legal purposes.

10. Automated Decision-Making

SRA does not use automated decision-making or profiling in recruitment.

11. Your Rights

You have the right to:

  • Access your personal data

  • Request correction of inaccurate data

  • Request erasure (in certain circumstances)

  • Object to processing based on legitimate interests

  • Withdraw consent (where consent is used)

  • Restrict processing

  • Lodge a complaint with the Information Commissioner’s Office (ICO)

ICO: www.ico.org.uk

12. How to Contact Us

Data Protection Lead: CEO

Southside Rehabilitation Association Ltd 45 Knights Hill, West Norwood, London SE27 0HS

Email: office@sra-ltd.co.uk Telephone: 020 8766 6688

bottom of page