During the recruitment process, Costa Limited (“Costa”, “we”, “us” or “our”) will collect and process personal data relating to individuals who make job applications with Costa, including through costacareers.co.uk and costa.dayforcehcm.com (the “Website”).

If you are applying for a role with Costa, Costa is the controller of your personal data. We respect your data and your privacy is important to us.

This notice explains what personal data we collect and how it is used during the recruitment process, including when visiting and using the Website. This policy also explains what rights you have over your personal data and how you can use those rights. More information about your rights, and how to exercise them, is set out in the "Your rights" section of this notice.

Costa’s registered office is 3 Knaves Beech Business Centre, Davies Way, Loudwater, High Wycombe, Buckinghamshire, HP10 9QR.

What information do we collect?

If you apply for a role with Costa, we will process a range of information about you, and this may be personal data or special category data which is more sensitive than ordinary personal data. The data we may process includes:

your name, title, address and contact details, including email address and telephone number;
your Costa recruitment account information including your username and password;
a copy of an identity document such as a passport or driving licence, and the data contained within the document;
details of your education, qualifications, skills, experience and employment history, including start and end dates with previous employers as well as any references;
the results of an online assessment that we may request you take as part of the recruitment process;
your employment preferences, such as location, type and hours of work with us;
information about your current level of pay, including entitlement to any benefits connected to your employment;
your nationality and entitlement to work in the UK;
your image if collected through Costa CCTV if you visit us in store or at our offices;
where necessary, details about medical or health conditions, including whether or not you have a disability for which we need to make reasonable adjustments during the recruitment process (special category data);
equal opportunities monitoring information, including information about your ethnic origin, sexual orientation, health and religion or belief (special category data); and
any other information you provide to us in your application form or CV, or otherwise during the recruitment and application process.

In addition, when you visit the Website or apply for a role through the Website, we may process information collected automatically relating to your use of the Website, such as your IP address and details regarding how you use the Website, such as when you visited the Website and the browser you used. To collect such information, we use cookies and similar tracking technologies. For more information on how we use these cookies and similar tracking technologies, the purposes for using them, and details on how to adjust your settings, please see the Costa Cookie Policy.

We may collect this information in a variety of ways. For example, data might be collected through application forms, CVs or resumes, obtained from your passport or other identity documents, or collected from you through interviews or other forms of assessment.

We may also collect personal data about you from third parties, such as your recruitment agency, former employers, a relevant professional body, external organisations who carry out right to work checks, the Disclosure and Barring Service (where applicable and/or required for specific roles), the Home Office and, where applicable, external bodies which arrange assessments of applicants.

Information about criminal convictions

Whilst Costa may not regularly require applicants to provide information relating to any criminal convictions, for some roles there may be a need to provide this information. For example, where you are required as part of the role you are applying for to be accountable for cash and stock.

We will only collect such information if it is appropriate given the nature of the role and where we are legally able or required to do so. Where applicable, we will collect it as part of the recruitment process and use this information to review and consider your application in light of any such information disclosed to us.

What if you do not provide personal data?

You are under no legal or contractual obligation to provide data to Costa during the recruitment process. However, if you do not provide the information, we may not be able to process your application properly or at all. In relation to certain information, such as evidence relating to your right to work in the UK, we are under a legal obligation to obtain that information and if you do not provide it then we will be unable to offer you employment.

Why do we process personal data?

We need to process data to take steps at your request prior to entering into an employment contract with you. We also need to process your data to then enter into an employment contract with you if your application is successful. For example, we need to process your data to provide you with an employment contract which contains your correct details.

In some cases, we need to process data to ensure that we are complying with our legal obligations. For example, we are required by law to check an applicant's eligibility to work in the UK before we are able to employ them. We may also process your data to respond to and defend legal claims, to make disclosures to law enforcement agencies or in relation to health and safety compliance and/or for auditing and regulatory purposes.

In other cases, we have a legitimate interest in processing personal data during the recruitment process and for keeping records about the process. Processing data from applicants allows us to properly and consistently manage the recruitment process, assess and confirm an applicant’s suitability for employment and decide whether an applicant should be offered employment. We also have a legitimate interest in in processing personal data for the purpose of securing our sites, property and personnel using CCTV. Where we rely on legitimate interests as the justification for processing personal data, we have carried out a balancing exercise in respect of those interests compared to the rights enjoyed by individuals.

In relation to special categories of personal data, we may process information about your health if we need to make reasonable adjustments to the recruitment process for candidates who have a disability. This is in order to comply with our employment law obligations and exercise specific rights in relation to employment.

Where we process other special categories of personal data, such as information about ethnic

origin, sexual orientation or religion or belief, this is done for the purposes of equal opportunities monitoring. This is in order that we can promote and maintain equality of opportunity and also in order that we can carry out monitoring which is for reasons of substantial public interest for the purpose of keeping such equality of opportunity under review.

Who has access to data?

Your information will be shared internally at Costa, including with affiliates, for the purposes of the recruitment exercise. This includes members of the HR and recruitment team, interviewers involved in the recruitment process, relevant managers in the business and IT staff if access to the data is necessary for the performance of their roles. We will also share information about your application with your recruitment agency, if applicable.

We share your data with third parties which provide services to us under contract, such as IT hosting services in connection with the operation of the application system. If your application for employment is successful then your data will be shared further for the purposes of managing both the business and the employment relationship, and a further privacy notice will be issued to you explaining how and why we will use your personal data as an employee.

Your data may be transferred outside of the UK or the European Economic Area (EEA) for the purposes of processing or storage. If we do transfer information outside of the UK/EEA we will ensure that it is protected by using one of the following safeguards:

Transferring the data to a non-EEA country which the UK/EU has decided provides the same level of protection as required within the UK/EEA.
Entering into a contract with the recipient of the data which requires them to protect it to the same standards as required within the UK/EEA or use other sufficient mechanisms and measures to achieve adequate protection. This may include the use of Standard Contractual Clauses published by the UK/EU.
Using binding corporate rules. These are internal rules adopted by group companies to allow international transfers of personal data to entities within the same corporate group located in countries which do not themselves provide an adequate level of protection.

How do we protect data?

We take the security of your data seriously and are committed to taking all reasonable steps to protect the data we hold. We have a range of internal policies and security controls in place to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by our employees who need such access in the proper performance of their duties. Our security measures are kept under review and updated and enhanced as appropriate.

For how long do we keep data?

If your application for employment is unsuccessful, we will hold your data on file for 6 months after the end of the relevant recruitment process. If you provide consent to allow us to keep your personal data on file, we will hold your data for a further 6 months for consideration for future employment opportunities that may become available after the time that you originally made your application. At the end of the relevant period, or if you withdraw your consent (if applicable), your data will be deleted or destroyed.

If your application for employment is successful, personal data gathered during the recruitment process will be transferred to further internal systems and retained during your employment. A new privacy notice will be issued to you explaining how and why your data will be processed and retained if you enter into employment with us.

Your rights

As a data subject, you have a number of rights. You may be able, subject to the limitations mentioned below, to:

Make a data subject access request. You are entitled to receive a copy of the personal data we hold about you and certain details regarding how we process it.
Request correction of the personal data that we hold about you.
Request erasure of your personal data.
Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and your particular circumstances mean that you want to object to processing on this ground.
Request the restriction of processing of your personal data. This enables you to ask us to suspend the processing of personal data about you, for example if you want us to establish its accuracy or the reason for processing it.
Request the transfer of your personal data to another data controller.

These rights may be limited, for example if fulfilling your request would reveal personal data about another person, where you object to us processing personal data but we have a compelling justification for continuing to process it, or you ask us to erase information which we are required by law to keep or have another compelling reason to retain it. In addition, relevant exemptions are also included within the data protection laws that apply in the UK. We will inform you of any relevant exemptions that apply and which we rely upon when responding to any request you make.

If you would like to exercise any of these rights, please use the contact details provided under the “Contact us” section below.

You also have the right to submit a complaint to the Information Commissioner’s Office. You can contact them by calling 0303 123 1113 or online at www.ico.org.uk/concerns. However, we would appreciate the opportunity to discuss any concerns before you do so.

Contact us

If you have any questions about this privacy notice or our privacy practices, or if you wish to exercise any of your data protection rights, please contact our Data Protection Officer using the following details:

E-mail: costadpo@costacoffee.com

Post: Costa Data Privacy Office, Costa Limited, 3 Knaves Beech Business Centre, Davies Way, Loudwater, Bucks, HP10 9QR