Job Applicant Privacy Notice

This privacy notice explains how the personal data of job applicants is processed.

Info This page was last reviewed and updated 12 June 2024.


The type of personal information we collect

To manage individuals’ applications to work or volunteer with the Link group of organisations, Link may collect and process the following information about you as appropriate to the vacant position applied for :

  • Link careers portal username and password (if applying online);  
  • applications that have been submitted to a specified vacancy;  
  • your title, forename, middle names and surname, previous surnames, pronouns, name you prefer to be known by, address and contact details, including email address and telephone number;  
  • details of your qualifications, professional memberships, skills, experience,  employment history, breaks in employment/volunteering history unrelated to familial leave such as maternity, adoption, shared parental leave;  
  • when applying for employee and worker vacant positions, information about your current level of remuneration, including benefit entitlements;  
  • whether or not you have a disability for which the organisation needs to make reasonable adjustments during the recruitment, selection and vetting process;  
  • information about your entitlement to work in the UK e.g. a valid passport;  including details of any legal restrictions;
  • information to confirm your identity and proof of address;  
  • information on your relationship of any friends or relatives that are members of Link’s Board of Management, Committees or staff;  
  • name, position and employee reference number of the Link employee that referred you to the job vacancy if submitting an application under the Refer a Friend recruitment scheme;
  • information on if you have a current driving licence and/or access to a vehicle;  
  • information on two appropriate individuals that can provide a reference on your suitability for the post in which you have applied;      
  • information on unspent criminal convictions or offences if the vacant/volunteer position does not require a disclosure check from Disclosure Scotland; or
  • information on criminal convictions or offences as appropriate to the level of disclosure check from Disclosure Scotland as required by legislation. For more information, please refer to the Disclosure Scotland website and helpline.
  • details of your bank account if reimbursement of a pre-approved expense is required related to the recruitment and selection process e.g. reasonable adjustment.
  • information on your skills, experience, competency, values, behaviors through selection assessments; and    
  • with your consent information on where you heard of the vacancy and equal opportunities monitoring information is not needed for the purposes of recruitment and selection so it is optional for you to provide.  
  • If you are offered a post, additional information may be requested from you, as outlined in our employee and worker privacy notice or volunteer privacy notice.  
  • If you visit one of Link’s premises then you may be recorded on our CCTV recordings;
  • If you make or receive a telephone call using Link’s external voice communication system, Link may record it.  Recording customer conversations allows Link to assess customer satisfaction, train and develop staff, review call quality, and have access to a verbal record of what is said in the event of a subsequent complaint. It may also mean employees feel more protected knowing that any threatening behaviour can be evidenced and acted upon where necessary.

How we get the personal information and why we have it

We need your information to process your application for the following reasons:  

  • Link needs to process data prior to entering into a contract with you. It also needs to process your data to enter into a contract with you if your application is successful;  
  • Link needs to process data to ensure that it is complying with its legal obligations. For example, it is required to check a successful applicant's eligibility to work in the UK before employment/contract for service starts;  
  • Link processes health information if it needs to make reasonable adjustments to the recruitment and selection process for candidates who have a disability. This is to carry out its obligations and exercise specific rights in relation to the Equality Act 2010;  
  • Link is obliged to seek information about criminal convictions and offences. Where the organisation seeks this information, it does so because it is necessary for it to carry out its obligations and exercise specific rights in relation to certain posts, as a provider of “regulated work” as defined by Scheduled 2 and 3 of the Protection of Vulnerable Groups (Scotland) Act 2007 and the Police Act 1997;   
  • Link follows part V of the Police Act 1997, a legislative framework for the disclosure of criminal convictions and non-conviction information.  It is also the means by which information is disclosed for employment purposes in Scotland for those people not covered by the PVG scheme
  • Link complies with the Disclosure Scotland Code of Practice in the use, storage, retention and destruction of disclosure information.
    • Link will use disclosure information only for the purpose for which it was requested and provided. Link will not share disclosure information with a third party unless the subject has given their written consent and has been made aware of the purpose of the sharing.
    • Link does not keep disclosure information for longer than necessary. This will likely be the date the relevant decision has been taken, allowing for the resolution of any disputes or complaints and/or the date an individual ceases to do regulated work for Link. 
    • Link will not retain any paper or electronic image of the disclosure information. Link will record the date of issue, the individual’s name, the disclosure type and the purpose for which it was requested, the unique reference number of the disclosure and details of our decision. 
    • Link ensures that disclosure information is destroyed in a secure manner i.e. by shredding or deletion of electronic images or records. We will ensure that disclosure information which is awaiting destruction will be kept in a secure locked cabinet.
  • Link has a legitimate interest in processing personal data during the recruitment process and for keeping records of the process. Processing data from job applicants allows Link to manage the recruitment process, assess and confirm a job applicant’s suitability for employment/engaging on a contract for service and decide to whom to offer a job/contract for service/volunteer opportunity;   
  • Link may also need to process data from job/volunteer applicants to respond to and defend against legal claims;  
  • where Link processes other special categories of data, such as information about ethnic origin, sexual orientation, health or religion or belief, this is for equal opportunities monitoring purposes and is at your discretion to provide;  
  • where Link relies on legitimate interests as a reason for processing data, it has considered whether or not those interests are overridden by the rights and freedoms of employees or workers and has concluded that they are not;  
  • Link will not use your data for any purpose other than the recruitment, selection and if appropriate vetting process for the post(s) in which you have applied.  

 Some of Link’s recruitment processes are occasionally based on automated decision-making. For example at the beginning of an online application, you may be asked a number of questions that require a yes or no answer. The answers you provide to these questions may automatically end the application process as based on the information provided you do not meet the legal and/or essential criteria for the vacancy. A question may ask if you have the right to work in the UK, if a job applicant answered no to the question, then the application would end and would not be taken forward to the recruitment and selection process. The job applicant is welcome to contact Link Human Resources to discuss the reason if this happens.    

The majority of information that we store and process about you is provided directly by yourself, typically through the following methods:

  • Application forms and CV’s
  • Identity documents (such as passports, driving license, work visa)
  • Information gathered from interviews, role specific testing, and supporting statements

During the selection process Link will seek information from third parties as appropriate to the selection process for the post: 

  • when an applicant has advised they require a reasonable adjustment to participate in recruitment and selection process, Link may seek independent medical advice from an Occupational Health provider to support making the appropriate reasonable adjustments;
  • when a selection process requires the use of a third party to process the assessment, information will be provided to them to undertake this service on our behalf.  

Link will seek information from the following third parties only once a job offer/contract for service has been made and verbally accepted and will inform you that it is doing so. Link may disclose your information as appropriate to third parties who act for us for the purposes set out in this notice including the following:   

  • former employers and/or referees to obtain references for you and as an employment/contract for service background check;  
  • Pre-Employment/Volunteer Placement Health Assessment Questionnaire is completed by you and sent directly to Link’s Occupational Health Provider for processing. The outcome of the assessment is shared with Link and if appropriate to the outcome of the initial assessment, further medical reports or assessments may be required with your consent;   
  • based on the legal requirement of the post you have applied for, if you are not already a member of the Disclosure Scotland PVG Scheme, you will be required to complete and return an application form to obtain necessary criminal records and disclosure checks at the time and for the duration of your appointment to the post;  
  • based on the legal requirement of the post you have applied for, you may be required to complete a Disclosure Scotland criminal records and disclosure check at the time of appointment and every three years thereafter for the duration of your appointment to the post;  
  • based on the requirements of the post you have applied for you may require a driving licence and, if necessary, have access to a roadworthy vehicle with the required insurance to drive for business purposes. If this is the case, then your details will be provided to a third party to undertake these checks on our behalf;   
  • based on the requirements of the post, Link may need to validate that you have the required qualifications and/or professional memberships from the issuing body in circumstances e.g. Scottish Social Services Council;    
  • if necessary, Link may need to seek advice from regulatory bodies on your legal right to work in the UK;  
  • if necessary, Link may seek legal advice in relation to the processing of your application in relation to the recruitment, selection and vetting processes and outcomes.   

Link will not transfer your data outside the European Economic Area.  

Under the UK General Data Protection Regulation (UK GDPR), the lawful bases we rely on for processing this information are:

Personal data

  • Your consent.
  • We have a contractual obligation.
  • We have a legal obligation.
  • We have a vital interest.
  • We need it to perform a public task.
  • We have a legitimate interest.

Special category data

  • Explicit consent
  • Employment, social security and social protection (if authorised by law)
  • Vital interests
  • Not-for-profit bodies
  • Made public by the data subject
  • Legal claims or judicial acts
  • Reasons of substantial public interest (with a basis in law)
  • Health or social care (with a basis in law)
  • Public health (with a basis in law)
  • Archiving, research and statistics (with a basis in law)

Processing of special categories and criminal offence data

As part of Link’s Recruitment and Selection process, our lawful basis for processing special category and criminal convictions data under UK GDPR are set out in Schedule 1, Data Protection Act 2018. Link must meet at least one of the thirty-seven conditions set in this schedule to process criminal data. Link meets the following conditions:


This condition is met as the data subject has given consent to the processing of a basic disclosure check or a PVG check (applicable to the role applied for). 

Employment Purposes

This condition is met as the processing of relevant criminal conviction data is necessary for the purposes of performing or exercising obligations or rights which are imposed or conferred by law on the controller or the data subject in connection with employment.

If the role is covered by the Rehabilitation of Offenders Act 1974, and the role only requires basic disclosure, if asked about convictions, the employee must declare unspent convictions.

If the role is not covered by the Act and/or qualifies for higher level disclosure (PVG check) , the applicant should disclose both unspent and relevant spent convictions/cautions if asked to.

Where there is not a regulatory or legal requirement for a role to undertake a basic disclosure check, Link assesses whether a role requires a basic disclosure against the following criteria.

Does the role:

  • Involve potentially working with customers, tenants, services users, or members of the public on a 1-1 basis.
  • Have access to, or would be handling, sensitive financial information
  • Have access to, or would be working with, sensitive information relating to individuals’
  • Have access to, or would be working with, critical organisational infrastructure
  • Have the ability to engage in fraudulent behaviour which would pose a significant risk to the organisation
  • Have a contractual disclosure check requirement by the organisation whom Link is delivering services on behalf of

How we store your personal information

Data will be confidentially and securely stored in a range of different places, including on your online careers portal account, application record, in Link  management systems and on other IT systems (including email and SharePoint), third party portal e.g. occupational health  and in secured locked cabinets. 

How long we keep your personal information

We review our data retention periods regularly and will only hold your personal data for as long as is necessary for the relevant activity, or as required by law (we may be legally required to hold some types of information), or as set out in any relevant contract we have with you.    We will generally keep your information for the following minimum periods after which this will be destroyed if it is no longer required for the reasons it was obtained.

Data Retention

Data/Document Type

Condition of Processing  

Retention Period  

Speculative CV’s and information provided by potential job/volunteer applicants and/or recruitment agencies unrelated to a specific current vacancy.    

None applicable   

Destroyed on receipt. Employee and worker vacancies are advertised on the careers portal and Link only accepts applications for a vacant position when advertised.  

Volunteer vacancies are advertised.

Link Careers Portal – job applicant active profile account ( includes previously submitted application history).


Legal basis of processing is consent therefore account will be active until requested to be closed by job applicant or it becomes inactive (see below).   

Link Careers Portal – job applicant – inactive profile account.    This will include any saved job applications and the data contained within these including criminal convictions.


Closed after 1 year from last log-on if account is inactive.    

Unsuccessful job applicant data and correspondence submitted in relation to a vacancy.   Except for job applications stored on a job applicant’s active profile account

Consent and  


7 months from the vacant post(s) being offered and accepted, unless there is a legal basis for retaining for a longer period.  

Successful job applicant data submitted in relation to a vacancy.  


Transferred to employee/worker staff  file. The periods for which your data will be held will be provided to you in the employee and worker privacy notice.  

Information provided by Disclosure Scotland as part of a disclosure check to assess suitability to undertake regulated work in Link

Legal obligation

Contractual obligation

Vital Interest


Link does not keep disclosure information for longer than necessary. This will likely be the date the relevant decision has been taken, allowing for the resolution of any disputes or complaints and/or the date an individual ceases to do regulated work for Link.

Information on any pre-approved reimbursement of expenses to a job applicant for participating in selection and vetting process e.g. reasonable adjustments

Legal obligation


Link will retain the financial expense reimbursement record within Link for a maximum of 6 years after the end of the financial year in which the expense reimbursement occurred.

Your rights

Your right of access

You have the right to ask us for copies of your personal information. 

Your right to rectify

You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.

Your right to erasure

You have the right to ask us to erase your personal information in certain circumstances. 

Your right to restriction of processing

You have the right to ask us to restrict the processing of your personal information in certain circumstances. 

Your right to object to processing

You have the the right to object to the processing of your personal information in certain circumstances . However, if Link can demonstrate that there is a compelling reason to process such personal data then we may refuse to stop processing your personal data.  

Your right to data portability

You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you. 

Please contact us at if you wish to make a request. 

How to complain 

If you have any concerns about our use of your personal information, you can make a complaint to us at Link House, 2c New Mart Road, Edinburgh EH14 1RL or by email at  

You can also complain to the ICO if you are unhappy with how we have used your data. 

The ICO’s address:             

Information Commissioner’s Office 

Wycliffe House 

Water Lane 



SK9 5AF 

Helpline number: 0303 123 1113 

ICO website: 

Stay Connected