Job applicants – How we use your personal information

This page provides information about the use of personal information provided by job applicants to Cambridge Enterprise Ltd.

Back to Core Privacy Notices

As part of any recruitment process, Cambridge Enterprise collects and processes personal data relating to job applicants. We are committed to being transparent about how we collect and use that data and to meet our data protection obligations.

1. What is ‘personal information’?

‘Personal information’ means any information which relates to or identifies you as an individual.

2. What information does Cambridge Enterprise collect?

Cambridge Enterprise collects a range of information about you. This includes:

  • your name, address and contact details, including email address and telephone number;
  • details of your qualifications, skills, experience and employment history;
  • information about your current level of remuneration, including benefit entitlements;
  • whether or not you have a disability for which the organisation needs to make reasonable adjustments during the recruitment process;
  • information about your entitlement to work in the UK; and
  • equal opportunities monitoring information, including information about your ethnic origin, sexual orientation, health, and religion or belief.
  • if you are required to undergo an application for immigration purposes where a Certificate of Sponsorship through UK Visas and Immigration (UKVI) is required, further information can be found in Appendix One.

3. How does Cambridge Enterprise collect this information?

Cambridge Enterprise collects this information in a variety of ways. For example, data will be contained in application forms, CVs, obtained from your passport or other identity documents, or collected through interviews or other forms of assessment. We will also collect personal data about you from third parties, such as references supplied by former employers.  We will seek information from third parties only once a job offer to you has been made and will inform you that it is doing so.

Data will be stored in a range of different places, including on your application record, in HR management systems and on other IT systems (including email).

4. Why does Cambridge Enterprise process personal data?

Cambridge Enterprise will process the personal information provided on your application and the other information referred to above for the purposes of identifying you, processing your application, verifying the information provided and assessing your suitability for the role (including any relevant right to work checks), deciding whether to offer you a job, and communicating that outcome (together with any feedback).

We may also use or disclose the information provided for the following statutory or public interest purposes:

  • To prevent or detect fraud.
  • For equal opportunities monitoring.
  • To help us to make reasonable adjustments for any disability, as requested by you.
  • To provide statutory returns required by applicable legislation.
  • For research and statistical purposes, but no information which could identify you will be published.

We consider the processing of your personal information for the above purposes to be either necessary for us to take steps with a view to creating a contractual relationship with you (e.g. to assess your application for employment with us), or necessary for compliance with a legal obligation (e.g. equal opportunities monitoring), or necessary for the performance of tasks we carry out in the public interest (e.g. non-statutory reporting or research). We require you to provide us with the information we ask for during the application process in order to assess your application properly except where its supply is marked as optional. Recruitment decisions are not automated.

Cambridge Enterprise has a legitimate interest in processing personal data during the recruitment process and for keeping records of the process. Processing data from job applicants allows us to manage the recruitment process, assess and confirm a candidate’s suitability for employment and decide to whom to offer a job. We may also need to process data from job applicants to respond to and defend against legal claims.

Cambridge Enterprise processes health information if it needs to make reasonable adjustments to the recruitment process for candidates who have a disability. This is to carry out its obligations and exercise specific rights in relation to employment. Where Cambridge Enterprise processes other special categories of data, such as information about ethnic origin, sexual orientation, health or religion or belief, this is for equal opportunities monitoring purposes. Cambridge Enterprise will not use your data for any purpose other than the recruitment exercise for which you have applied.

5. Who has access to data?

Your information will be shared internally for the purposes of the recruitment exercise. This includes members of the HR team, interviewers involved in the recruitment process, managers in the business area with a vacancy and IT staff if access to the data is necessary for the performance of their roles.

Cambridge Enterprise will not share your data with third parties, unless your application for employment is successful and it makes you an offer of employment. We will then share your data with former employers to obtain references for you.  Where relevant and as required, we will share your data with UK Visas and Immigration in order to administer relevant recruitment checks and procedures.  On occasion we might share your data with companies or organisations providing specific services to, or on behalf of, Cambridge Enterprise.

We will not transfer your data outside the European Economic Area.

6. How does Cambridge Enterprise protect data?

Cambridge Enterprise takes the security of your data seriously. It has internal policies and controls in place to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by our employees in the proper performance of their duties.

7. For how long does Cambridge Enterprise keep data?

If your application for employment is unsuccessful, Cambridge Enterprise will hold your data on file for one year after the end of the relevant recruitment process (except if the person appointed to the post is sponsored under the UK’s points-based immigration system, when we are required to retain the applications of all candidates shortlisted for final interview for one year or until a Home Office compliance officer has examined and approved them, whichever is the longer period).  At the end of that period, your data is deleted or destroyed.

If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your personnel file and retained during your employment. The periods for which your data will be held will be provided to you in a new privacy notice.

As a subsidiary of the University of Cambridge, we follow the University’s guidance on information retention.  Information about how long different types of information are retained by the University is published here.

8. Your rights/ who can I contact?

As a data subject, you have a number of rights. You can:

  • access and obtain a copy of your data on request;
  • require us to change incorrect or incomplete data;
  • require us to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing;
  • object to the processing of your data where we are relying on its legitimate interests as the legal ground for processing; and
  • ask us to stop processing data for a period if data is inaccurate or there is a dispute about whether or not your interests override the organisation’s legitimate grounds for processing data.

If you would like to exercise any of these rights, please contact:

Deputy Director

Data Protection

Cambridge Enterprise Limited

University of Cambridge

Hauser Forum

3 Charles Babbage Road



You can also make a subject access request; to find out more visit Making a Subject Access Request.

9. What if you do not provide personal data?

You are under no statutory or contractual obligation to provide data to the organisation during the recruitment process. However, if you do not provide the information, the organisation may not be able to process your application properly or at all.

You are under no obligation to provide information for equal opportunities monitoring purposes and there are no consequences for your application if you choose not to provide such information.

10. How do I complain?

If you are not happy with the way your information is being handled, or with the response received from us, you have the right to lodge a complaint with the Information Commissioner’s Office at Wycliffe House, Water Lane, Wilmslow, SK9 5AF (

11. Are changes made to this page?

This web page was last updated in May 2019. It is reviewed when necessary and at least annually. Any changes will be published here.

Appendix 1: Application for immigration purposes

Some applicants may be required to undergo an application for immigration purposes where a Certificate of Sponsorship through UK Visas and Immigration (UKVI) is required.  In such a case, we will only use any information gathered as part of the relevant checks or procedures for that specific purpose, and we will handle, store, retain and destroy relevant materials in accordance with applicable legislation and codes of practice. This means that access to any relevant materials (including any forms completed by Cambridge Enterprise) is strictly controlled, and they are retained for no longer than strictly necessary to fulfil the purpose in accordance with the legislation. Wherever possible we will not retain original documents or print-outs and instead will make a note on our HR database that the relevant check or procedure has been completed. We will only share any relevant information with external parties insofar as we are required to do so. We recognise that for some checks and in some circumstances it is a criminal offence to pass any information on to anyone who is not entitled to receive it.

Back to Core Privacy Notices