Contents

Contents 3

Introduction 4

Categories of personal data processed 5

Use of Artificial Intelligence (AI) 10

Your rights 11

Fraud Prevention Agencies - CIFAS 11

Data Protection complaints 13

Introduction

This notice relates specifically to individuals who apply for roles within Vanquis Banking Group (VBG) (including other companies within the Group: Vanquis Bank Ltd (VBL), USnoop Limited (Snoop), Recruitment Agencies on behalf of potential candidates and individuals who act in the capacity of a self-employed worker, working on behalf of VBG or other companies listed above. It explains how we use your personal data and describes the categories of personal data we process and for what purposes. It applies when you use this website, any of our apps or when you apply for roles within VBG. We are committed to collecting and using personal data fairly and in accordance with the requirements of the UK General Data Protection Regulations (UK GDPR) and the Data Protection Act 2018.

We are committed to ensuring that your information is kept safe, secure and used responsibly, and we have put in place appropriate technical and other security measures to protect it.

The identity of the controller and their contact details

This privacy notice explains how VBG, the recruiter and operators of our recruitment websites use your personal information submitted during the recruitment process and provides information about your rights in relation to your personal information.

VBG is the controller of your information. This privacy notice applies to your use of the recruitment websites. We may update this privacy notice and so you should check it from time to time and always before you submit an application to us, to make sure that you are happy with any changes that may have been made. Our aim is to be as clear and open as possible about what information we collect from you, what we do with your personal data, how we use it and your rights as the data subject. If you apply for a position using our online recruitment services, we will use the information you provide (including personal data) for the recruitment purposes outlined in this privacy notice.

Within the VBG we may share your personal data between:

Vanquis Banking Group Plc. Registered number 0668987 England
Vanquis Bank Limited. Registered number 02558509 England
USnoop Limited. Registered number 11797870 England

The registered address for these companies is: Fairburn House, 5 Godwin Street, Bradford, BD1 2AH

The identity of the Data Protection Officer

Vanquis Banking Group has a Data Protection Officer (DPO) to ensure that your personal data is being treated fairly and lawfully and protected at all times.

If you need to contact the DPO please email: dataprotection@vanquis.com or write to the Data Protection Officer, Fairburn House, 5 Godwin Street, Bradford, BD1 2AH.

Categories of personal data processed

You can look through our recruitment websites without giving us any personal data. You are under no statutory or contractual obligation to provide data to us during the recruitment process, however, if you don't provide the necessary information, we may not be able to process your application.

If you decide to apply for a role via the site we will need to collect and process your personal data.

Where we need to process special categories of personal data, this will only be done with your explicit consent (unless we feel the processing is necessary to protect your vital interests) or if we are obliged to process under employment or financial crime legislation.

‘Special categories of personal data’ – includes data about your:

Health
Race or ethnicity
Religion or other beliefs of a similar nature
Sexual life or orientation
Trade Union membership
Political opinions, and
Genetic or biometric data about you

Personal Data we process, includes:

Name, address and postcode – without this we would not be able to identify you as an applicant or know where to send recruitment information to. We also need this to process the necessary pre-employment checks.
Email address – we will send a confirmation of your application via email. We may use email to advise you of similar alternative vacancies if you have consented to us doing so. We may also contact you by email if you have only partially completed an application.
Contact telephone numbers – if there are any problems with your application or we need to clarify anything with you, we need to be able to contact you quickly.
Username and password – this is to keep your personal data secure and so that you can return to a partially completed application at a later date.
Your application – this is required so that we may assess you. We will collect and process data about your skills (including education, professional qualifications and training) and employment history. You should only provide the information requested on the application form.
Disability data – any indication regarding a condition, impairment or disability as defined under the Equality Act 2010 to allow us to use it for the purposes of making any reasonable adjustments during the recruitment process.
Demographic information - such as gender, ethnicity, disability status, sexual orientation, and other protected or self‑identified characteristics, to understand our workforce, support equality, diversity and inclusion, and meet our obligations under the Equality Act 2010. This helps us monitor fairness, identify barriers, and improve colleague experience.
Background checks – we will use your personal data when we perform background checks, using internal/external databases and external agencies, to assess your fitness to work for an authorised consumer credit business.
Other personal data specified during the online application process that is relevant to recruitment.

If your application is successful and we make a conditional job offer to you we will also require details of your referees, your National Insurance number and any other proof of your right to work in the UK, for example visa or working permits, where applicable, your visa history, proof of ID, bank details, date of birth, address history, details of any adverse financial history and next of kin (if applicable).

Why we process your data

As a business we use the data we obtain from you and the information we collect about you (from your application form, through interviews or other forms of assessment) to perform a number of activities. Under data protection law we are only allowed to use your personal information where we have a legal basis to do so. We set out below an explanation of the legal basis that we rely on to allow us to use your information.

In most cases any data Vanquis Banking Group obtains may be shared amongst its other companies to ensure that we are managing your relationship with us in the most informed way e.g. if you apply for a vacancy in another part of the group.

Processing your data as a Legitimate Interest

As outlined above we may process and sometimes share your information within the other companies of the Group for administrative activities where we have a legitimate business need. Some examples are:

To maintain internal record keeping.
To provide general aggregate information (which does not identify individuals) and statistics to help VBG develop its websites and services.
During the recruitment process
For keeping records such as using interview transcription tool during virtual interviews to support note taking and ensure a fair and consistent assessment.
To manage the recruitment process, assess and confirm a candidate’s suitability for employment.
Deciding to whom to offer a job.
To respond to and defend against legal claims.

Processing your data for legal reasons

VBG needs to process data to ensure that it is complying with its legal obligations. For example, to check that a successful applicant has a valid right to work in the UK before their employment commences, and where applicable, to request and process information relating to their immigration and visa history to support the organisation’s sponsorship duties, Skilled Worker visa applications, or ongoing right to work compliance.

To carry out its obligations and exercise specific rights in relation to employment such as processing information about whether or not applicants are disabled to make reasonable adjustments for candidates who have a disability.

In the UK, the Financial Conduct Authority (FCA) requires us to carry out specific fitness and probity checks on successful applicants, including credit checks, criminal record checks, fraud database checks, FCA Register checks, directorships and civil litigation checks, media searches and employer / academic / professional membership reference checks for staff who will be operating in Senior Manager/ Certified Functions.

We will treat your information as private and confidential but may share it with other companies within the group and disclose it outside the Group if we are legally obliged to do so.

Processing your data for contractual reasons

There are a number of activities that we will perform to use your data to administer your employment application with us in line with any contractual or pre-contractual requirements. Some examples of the contractual processing we undertake are:

To approach your nominated referees for the purposes of obtaining references.
To consider you for the position for which you have applied, and subsequent suitable vacancies (where you provide your consent to this).
Make up part of your personnel records if your application is successful (but only to the extent that such information is relevant to your on-going employment).
Undertaking background searches to assess your suitability working for the company, such as your previous employment/engagement records at VBG (if applicable), employer / academic / professional membership reference checks, criminal record checks, passport checks, identity checks..
Checks of external public record databases such as the FCA register/Companies House records for directorships information, court records for civil litigation cases and media records.
Credit Reference Agency Data – we conduct credit agency searches to identify whether you have any court judgements, bankruptcies, IVAs, debt release orders or defaults.
Fraud Prevention Agency Data – we will conduct internal and external Fraud Prevention Agency searches.
Customer database checks – we will review our customer databases and identify whether you hold an account with one or more of our businesses and status of that account.
Internal HR database checks – we will review our internal systems to identify if you have been previously employed with one of our companies.

Processing your data with your consent

There will be circumstances where we will only process your data if we have your consent to do so. For example, if you provide us with data that is classed as a special category of Personal Data, such as health information, we will only process this with your permission (unless we feel the processing is necessary to protect your vital interests) and you have a right at any time to ask us to stop the processing of that specific data. Where you provide personal data about somebody else, for example, your referees, you should ensure that they have given their consent.

In addition, with your permission where you have accepted a job offer from us, we will collect and use demographic information—such as gender, ethnicity, disability status, sexual orientation, and other protected or self‑identified characteristics—to understand our workforce, support equality, diversity and inclusion, and meet our obligations under the Equality Act 2010. This helps us monitor fairness, identify barriers, and improve colleague experience. Providing this information is voluntary, and it is kept confidential and only reported in an aggregated way. We also use ethnicity and disability data for Pay Gap Reporting, in line with data protection laws and only for statistical purposes. Your data is handled securely and is never used to make decisions about you individually.

Keeping your information accurate

It is your responsibility to ensure that all personal data you provide is true and is not misleading, deceptive or inaccurate in any way. If you believe any of the personal data we hold about you is incorrect, please log back into your account and amend your record. If at any time after the submission of your application you become unavailable to work, or if you simply change your mind, please log back into your account to withdraw your application.

In the event that you are unable to access your account to amend your details or withdraw your application or you do not have an account please contact careers@vanquis.com. Your personal data can only be viewed online when you log in to the site. Our login procedure minimises the risk of someone who is not the applicant doing this. You are responsible for keeping your password confidential. We ask you not to share this password with anyone.

Who do we share your data with

Your information may be shared internally for the purposes of the recruitment exercise. This includes members of the People team, interviewers involved in the recruitment process, managers in the business area with a vacancy and IT colleagues if access to the data is necessary for the performance of their roles.

Sometimes we use third party companies to help us administer your application to the company for example:

Criminal, credit, Third Party employment and gap references, CIFAS, fraud, sanctions and PEP (Politically Exposed Persons) lists which are administered through Experian.

Experian are subject to the same Data Protection obligations and stringent requirements, regardless of which country they are processing in.

How long do we keep your data for

If your application is successful, your information will be transferred into your employee record and subject to VBG's robust data protection controls. If you join you will be signposted to the Colleague Data Protection Notice to understand how your data will be processed and the retention periods that will apply to this data. If you are not successful in your application or you decide not to accept a job offer, we will retain the information you provide (including personal data) for 10 months for the purpose of maintaining a database of potential suitable candidates and may contact you about any suitable opportunities in the future.

We will ask for your consent before we keep your data for this purpose, and you are free to withdraw your consent at any time.

Processing your data outside the UK and EEA

We sometimes use third parties based outside the UK and European Economic Area. We will always ensure they will protect your information to UK standards.

When transferring data, we make sure that suitable protection is always maintained by ensuring appropriate safeguards are in place. This could be by:

Ensuring that we transfer personal data to countries that the Information Commissioner (ICO) has deemed to provide an adequate level of protection.
Putting suitable clauses in our contracts so that organisations take appropriate steps to give personal data the same protection it has in the EEA or the UK.

If you would like more information about these controls, please visit https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/

Sometimes these organisations may disclose information to foreign authorities in the fight against crime and terrorism where they are legally obliged to do so.

Equality Monitoring

We are required by law to make basic documentation checks on every candidate. Please note that you will be asked to provide documentation of your eligibility to work in the UK if you are invited to attend the next stage of the recruitment process with us. Other personal data (including special categories of personal data), for example, relating to your gender, race or ethnic origin, religion or belief, age bracket, details of any disability and sexual orientation is requested for the purpose of monitoring the effectiveness of our Equal Opportunities policy; this information is optional.

Use of Artificial Intelligence (AI)

We may use approved artificial intelligence (AI) tools, including Microsoft Copilot, to support our business, such as drafting content, summarising information, analysing data, improving productivity, and supporting service delivery.

Where AI tools process personal customer and / or colleague information, we remain responsible for ensuring that such processing complies with applicable data protection laws. Personal information may be included in information entered into AI systems and in AI-generated outputs, including information already accessible to you through our systems.

We require colleagues to use AI tools in accordance with our data protection, information security, and acceptable use policies, and to review AI-generated outputs for accuracy and appropriateness before use.

We implement appropriate safeguards to protect personal information, assess privacy and security risks before introducing AI systems, and, where required, carry out Data Protection Impact Assessments (DPIAs). We do not permit AI providers to use personal information processed on our behalf to train their own models unless specifically authorised and permitted by law.

Automated Decision-Making

We do not normally make decisions about colleagues based solely on automated processing that produce legal or similarly significant effects. Should this change, we will provide further information about the processing and the rights available to affected individuals. We may also monitor the use of our systems, including AI tools, to maintain security and ensure compliance with our policies and legal obligations.

Your rights

You have a number of other rights in relation to your personal data. For example you can ask for a copy of your personal data through a Subject Access Request, you can ask for your information to be corrected if it is inaccurate, you can ask for the processing of your data to be restricted whilst we may be resolving an issue, and you can ask for your data to be deleted, and you have the right to data portability. See below for additional information.

Your right to object

You have a right to object to any processing activity where the business states it has a legitimate business need to use your data in the way described.

Your right to data portability

Data Protection legislation contains a right to data portability that may give you a right in some data processing contexts, to receive your personal data in a portable format when it is processed on certain grounds, such as consent.

Obtaining a copy of your data

You have a right to access the personal data held about you. To obtain a copy of the personal data we hold about you and if you wish to exercise one of your rights, please write to or email:

Vanquis Banking Group plc and USnoop Limited: Peopleservices@vanquis.com or write to the People Services Team, Fairburn House, 5 Godwin Street, Bradford, BD1 2AH
Vanquis Bank Limited, email: Peopleservices@vanquis.com or write to the People Services Team, Compass South, Chatham Maritime, Kent, ME4 4YG.

We will review your request and respond to you within 30 days.

Fraud Prevention Agencies - CIFAS

General

We will check your details against the Cifas Databases established for the purpose of allowing organisations to record and share data on their fraud cases, other unlawful or dishonest conduct, malpractice, and other seriously improper conduct (“Relevant Conduct”) carried out by their Staff and potential Staff. “Staff” means an individual engaged as an colleague, director, trainee, homeworker, consultant, contractor, temporary or agency worker, or self-employed individual, whether full or part-time or for a fixed-term.
The personal data you have provided, we have collected from you, or we have received from third parties will be used to prevent fraud and other relevant conduct and to verify your identity.
Details of the personal information that will be processed include: name, address, date of birth, any maiden or previous name, contact details, document references, National Insurance number, and nationality. Where relevant, other data including employment details will also be processed.
We and Cifas may also enable law enforcement agencies to access and use your personal data to detect, investigate, and prevent crime.
We process your personal data on the basis that we have a legitimate interest in preventing fraud and other Relevant Conduct, and to verify identity, in order to protect our business and customers and to comply with laws that apply to us. This processing of your personal data is also a requirement of your engagement with us.
Cifas will hold your personal data for up to six years if you are considered to pose a fraud or Relevant Conduct risk.

Consequences of processing

Should our investigations identify fraud or any other Relevant Conduct by you when applying for or during the course of your engagement with us, your new engagement may be refused or your existing engagement may be terminated or other disciplinary action taken (subject to your rights under your existing contract and under employment law generally).
A record of any fraudulent or other Relevant Conduct by you will be retained by Cifas and may result in others refusing to employ you. If you have any questions about this, please contact us using the details provided.

Data transfers

Cifas may allow the transfer of your personal data outside of the UK. This may be to a country where the UK Government has decided that your data will be protected to UK standards, but if the transfer is to another type of country, then Cifas will ensure your data continues to be protected by ensuring appropriate safeguards are in place.

Your rights

Your personal data is protected by legal rights, which include your rights to object to our processing of your personal data, request that your personal data is erased or corrected, and request access to your personal data.
For more information or to exercise your data protection rights, please contact us using the contact details provided.

Data Protection complaints

If you have any concerns about how we process your personal information or how we handle requests relating to your data protection rights, you have the right to make a complaint to us by emailing: psregulation&compliance@vanquis.com.

Once we have received your complaint, we will acknowledge it within 30 days and respond without undue delay. We will keep you informed of progress and aim to resolve your complaint as quickly as possible.

If you are not satisfied with our response, you have the right to complain to the UK Information Commissioner’s Office (ICO) whose address is: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Telephone: 0303 123 1113. You can find out how to report a concern on their website at: https://ico.org.uk/reportaconcern.

Version Control

Version No.	Date of Review	Reason for Change	Brief description of Change	Approved by	Date Approved
1	16/05/2023	Aligned Privacy Notice	Aligned Privacy Notice	DPO	01/08/2023
2	16/08/2024	Annual review & Inclusion of Snoop		DPO	19/09/2024
3	30/07/2025	Change of Company Address & re-branding	Updated registered office address	DPO	01/10/2025
4	13/03/2026	Update to Legitimate Interests	Inclusion of Recruitment transcripts and right to work data	DPO	25/03/2026
5	18/06/2026	Your Privacy Rights	How to make a complaint	DPO	19/06/2026
6	16/07/2026	Use of AI	Added	DPO	16/07/2026

Congratulations – your application has been submitted!