Privacy Policy Citation Group Recruitment
Date of publication: 15/05/2026We at Citation Group manage our employer branding and recruitment process through our career site (the “Career Site”) and by using a related applicant tracking system. In this privacy policy, we explain how we process your personal data if: -
- You visit our Career Site (you being a “Visitor”);
- You connect with us via our Career Site to create a profile and receive information about current or future vacancies (you being a “Connecting Candidate”);
- You apply for a position with us via our Career Site or a third‑party service (you being an “Applying Candidate”);
- We collect information about you from other parties, sites, or services because we believe your profile may be of interest for current or future vacancies (you being a “Sourced Candidate”);
- We receive information about you from our employees or partners who believe your profile may be of interest (you being a “Referred Candidate”);
- We receive information about you from a Candidate who lists you as their reference (you being a “Reference”).
This privacy policy also explains what rights you have when we process your personal data and how you can exercise those rights.
When we use the term “Candidate”, we refer to Connecting Candidates, Applying Candidates, Sourced Candidates, and Referred Candidates, unless stated otherwise.
1. About processing of personal data
Personal data is any information that can be directly or indirectly linked to a living individual, such as name, email address, telephone number, or IP address.
Processing of personal data includes any automated or manual use of personal data, such as collecting, creating, analysing, sharing, storing, or deleting it.
There are laws and regulations governing how organisations may process personal data (“data protection laws”), which vary by jurisdiction. One example of such legislation is the EU General Data Protection Regulation (EU) 2016/679 (“GDPR”). Under data protection laws, the data controller is the entity that determines the purposes and means of processing personal data. A data processor processes personal data only on the controller’s instructions and for specified purposes.
The data controller is Citation Group Limited, together with relevant group companies where applicable (a list of group companies is provided at the end of this notice).
2. What personal data do we process?
All individuals
Device information – such as IP address, browser type and version, operating system, preferred language, screen resolution, geographic location, and device settings.
Technical and statistical data – information about how you use the Career Site, including visited URLs and site activity.
Communications data – records of communications with us, including emails, messages, video recordings, surveys, and information you add to your account.
Contact details – such as name, email address, telephone number, and postal address.
Candidates
Recruitment process data – interview notes, assessment results, test outcomes, and salary expectations.
Application data – CVs, cover letters, work samples, references, education, and qualifications.
Publicly available professional information – such as information from LinkedIn or employer websites.
Reference information – information provided by referees or employees or partners who refer you.
3. Where do we receive your personal data from?
All individuals
- From the Career Site when you visit or interact with it.
- Directly from you when you apply, connect with us, or communicate with us.
References
- From the Candidate who has listed you as a reference.
Candidates
- From public sources such as professional networking sites.
- From employees, partners, or recruitment service providers who refer or source you.
- From referees you have provided.
- From information created during the recruitment process, such as interview notes and assessments.
4. For what purposes do we process your personal data?
We process personal data for the following purposes: -
- To protect and enforce our rights and interests, including in connection with legal claims. - To share personal data with recipients as described in Section 5.
- To operate, maintain, secure, and improve the Career Site.
- To analyse usage and performance of the Career Site.
- To provide vacancy updates and recruitment communications.
- To review applications and candidate profiles and communicate with candidates.
- To source, evaluate, and contact candidates for current or future vacancies.
- To record interviews where agreed.
- To conduct surveys relating to recruitment.
- To obtain and evaluate references.
5. Who do we share your personal data with?
We may share personal data with: -
- Service providers supporting our recruitment and employer branding activities, including applicant tracking systems.
- Group companies providing systems or services for recruitment activities.
- Cookie providers, where you have consented, as described in our Group Policy.
- Public authorities where required by law.
- Parties involved in legal proceedings, where necessary to protect or defend our rights.
- Third parties involved in mergers, acquisitions, or corporate transactions, where relevant.
6. On what legal bases do we process your personal data?
We rely on the following legal bases, depending on the processing activity: -
Legitimate interests – for managing recruitment, sourcing candidates, communicating with candidates, and improving recruitment processes.
Contractual necessity – to take steps at your request before entering into an employment contract.
Consent – for activities such as job alerts, interview recording, or where required by law.
Legal obligation – to comply with applicable legal requirements.
You may withdraw consent at any time. Withdrawal does not affect processing carried out before consent was withdrawn.
7. International transfers of personal data
We aim to process personal data within the EU/EEA. Where personal data is transferred outside the EU/EEA, we ensure appropriate safeguards are in place, including: -
- Adequacy decisions by relevant authorities;
- Standard contractual clauses or equivalent safeguards; and
- Additional technical and organisational security measures where appropriate.
For further information, please contact us using the details in Section 9.
8. How long do we keep your personal data?
We retain personal data only for as long as necessary for the purposes for which it was collected, in line with our retention and information governance obligations.
Visitors - up to 12 months.
Connecting Candidates - while you remain connected or until you withdraw consent or request deletion.
Applying, Sourced, and Referred Candidates - up to 24 months after the recruitment process ends, unless you request earlier deletion or consent to longer retention. Successful candidates - recruitment data becomes part of the employee record. References - for as long as the associated candidate data is retained.
Legal claims - until the matter is fully resolved.
9. Your rights and how to exercise them
You may exercise your data protection rights by: -
- Using privacy features on the Career Site;
- Managing your account settings; or
- Contacting our Data Protection Officer at dpo@citation.co.uk.
Your rights under applicable data protection and privacy laws include the right to be informed, access, rectification, erasure, restriction, data portability (where applicable), objection, and withdrawal of consent.
If you have concerns about our handling of your personal data, you have the right to lodge a complaint with the relevant data protection or privacy supervisory authority in the country or jurisdiction where you are located, where you work, or where you believe an infringement of data protection law has occurred.
10. Automated decision‑making
We do not make decisions about candidates that are based solely on automated processing and that produce legal or similarly significant effects. Any tools used in our recruitment systems support human decision‑making and are always subject to human review.
11. List of Group Companies
Agendrix
Be Certified
Careskills Academy
Citation Canada
Citation Cyber
Citation Group Australia
Citation ISO Certification
Citation Limited
Disclosure Services
Flexebee
Food Alert
HSD
iHasco
Quiqsolutions
SMAS
Timetastic
Trust ID
uCheck
12. Updates to this privacy policy
We may update this privacy policy from time to time. We encourage you to review this page periodically to stay informed of any changes.