CANDIDATE PRIVACY POLICY

Effective date: 17 July 2026


1. Introduction

This Candidate Privacy Notice explains how XYZ Reality Limited (“we”, “us”, “our”) collects, uses, and protects personal data relating to job applicants and candidates. We are committed to protecting your privacy and handling your personal data lawfully, transparently, and securely.

2. Data Controller

XYZ Reality Limited is the data controller in respect of your personal data. Please direct all queries to privacy@xyzreality.com or to 338–346 Goswell Road, London EC1V 7LQ.

3. What Personal Data We Collect

In connection with your application for work with us, we may collect, store, and process the following categories of personal data:

  • Information on your CV and covering letter, including education, qualifications, and employment history;
  • Identification and contact data such as your sex, pronouns, name, date of birth, address, email, national insurance number, phone number, passport, and visa/immigration documents;
  • Interview notes and assessment results, and interview and offer letters;
  • Interview recordings, transcripts, and AI-generated summaries, where you attend an interview or assessment with us (see section 7 for details);
  • Information from third parties such as references and referee contact details;
  • Information about your health, including any medical condition and health and sickness records, which we may use to provide appropriate adjustments during the recruitment process (this is special category personal data, processed on the basis of Article 9(2)(b) UK GDPR);
  • Background checks such as right-to-work checks, criminal record checks, and regulatory or professional checks (criminal record data is processed under Article 10 UK GDPR and paragraph 29 or 36 of Schedule 1 to the Data Protection Act 2018, as applicable); and
  • Equality and diversity monitoring data (such as age, race, gender, disability), processed on the basis of substantial public interest (Article 9(2)(g) UK GDPR) as permitted by paragraph 8 of Schedule 1 to the Data Protection Act 2018.

4. How We Collect Your Data

We collect personal data through job applications submitted directly by you; recruitment agencies, background check providers, or third-party platforms; interviews, assessments, and communications (including any interview recordings and AI-assisted notes described in section 7); references provided by third parties; and publicly available professional information (e.g. LinkedIn).

5. How We Use Your Personal Data

We process your personal data to manage and assess your skills, qualifications, suitability for the role, and application; determine your suitability for employment; communicate with you throughout the recruitment process; comply with legal and regulatory obligations; carry out right-to-work, background, reference, and suitability checks; and maintain records of recruitment decisions.

6. Legal Bases for Processing

We rely on the following lawful bases under UK GDPR Article 6:

  • Legitimate interests (Article 6(1)(f)): assessing your skills and suitability, evaluating interview and assessment results, reviewing publicly available professional information, and maintaining records of recruitment decisions. Where we rely on legitimate interests we have carried out a Legitimate Interests Assessment (LIA); you may request a summary by contacting privacy@xyzreality.com;
  • Legal obligation (Article 6(1)(c)): right-to-work checks, criminal record checks where legally required, health and safety obligations, and applicable regulatory requirements;
  • Pre-contractual necessity (Article 6(1)(b)): communicating with you, making and communicating recruitment decisions, and processing steps required prior to entering a contract of employment or engagement; and
  • Consent (Article 6(1)(a)): used only for specific, optional processing such as retaining your details on a talent pool for future opportunities. Consent is sought explicitly and separately, withholding it has no bearing on your application, and you may withdraw it at any time.

If you fail to provide information when requested, we may not be able to process your application successfully.

7. Interview Recording and AI-Assisted Note-Taking

Where you attend an interview or assessment with us (including by video or telephone), we may record the session and use an AI-assisted note-taking tool to produce a transcript and summary of the discussion.

We do this on the basis of our legitimate interests (Article 6(1)(f) UK GDPR) in running an accurate, fair and efficient recruitment process and keeping a reliable record of what was discussed. You may ask us not to use the AI note-taker; if you do, we will take manual notes instead and this will not disadvantage your application.

An interview may involve information that reveals special categories of personal data (for example information about your health or disability, racial or ethnic origin, religious or philosophical beliefs, or trade union membership), and the transcript may record such information. Where we process special category data in this way, we do so on the basis of the substantial public interest condition of equality of opportunity or treatment under Article 9(2)(g) UK GDPR and Schedule 1 to the Data Protection Act 2018, and we have an appropriate policy document in place. We do not use the tool to assess or infer any such characteristics.

The tool processes the audio of the interview, a written transcript and an AI-generated summary. It does not make any decision about your application. All hiring decisions are taken by members of our team, who review the notes alongside other information; the AI output is used only as a record and does not by itself determine the outcome (see also section 13, Automated Decision-Making).

The provider processes your information only on our documented instructions. It does not use the recording, transcript or summary to train, develop or improve its own products or artificial intelligence models, or for any purpose of its own.

The provider acts as our processor under a written data processing agreement. Your information is accessible to the members of our recruitment and HR teams involved in your application and is stored within our applicant tracking system. Where Ashby processes your information outside the UK, we put appropriate safeguards in place as described in section 8 (International Transfers).

Automated transcripts can contain errors. You may ask for a copy of the transcript or summary relating to you and ask us to correct anything inaccurate.

We keep the interview recording, transcript and summary only for as long as is necessary. In particular, we delete the audio recording once the transcript has been checked and it is no longer needed; the transcript and summary are then retained in line with our recruitment retention schedule (see section 9, How Long We Retain Data).

You have the right to object to this processing. You also have the right to access, rectify and erase your personal data, and to restrict its use. These and your other rights are set out in full in section 11 (Your Data Protection Rights).

8. International Transfers

Where personal data is transferred outside the UK and EEA, appropriate contractual safeguards are used (e.g. UK adequacy regulations, International Data Transfer Agreements (IDTAs), or UK Addenda to EU Standard Contractual Clauses). Data is protected in accordance with UK GDPR requirements. You can obtain a copy of the relevant safeguards, and further information, by contacting privacy@xyzreality.com.

9. How Long We Retain Data

We retain candidate data for: successful candidates — as part of the employee personnel file and up to six years post-termination; and unsuccessful candidates, criminal records, and equality and diversity monitoring data — typically up to two years after the recruitment process ends. Longer retention may apply where legal claims are anticipated, regulatory requirements apply, or you ask to be informed of future opportunities. Interview recordings, transcripts and summaries are retained as described in section 7.

10. Who We Share Your Data With

We may share your data with HR personnel and hiring managers; recruitment agencies; assessment providers; background screening providers; IT and HR system providers (including the provider of our AI-assisted note-taking tool, as described in section 7); and regulators or authorities where legally required. All third parties are required to maintain appropriate confidentiality and security standards and may only process your data for specified purposes in accordance with our instructions. We may disclose personal data where required by law, government, or regulatory authorities; to establish, exercise, or defend legal rights; and for purposes of preventing crime and fraud.

11. Your Data Protection Rights

You have the right to access your personal data and receive a copy; request rectification of inaccurate or incomplete data; request erasure (subject to legal exceptions); object to processing where we rely on legitimate interests; request restriction of processing; data portability (where applicable); and withdraw consent at any time where consent is the legal basis, without affecting the progress or outcome of your current application. To exercise any of these rights, contact privacy@xyzreality.com.

12. Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, alteration, or disclosure. Access is limited to those with a business need to know, who are subject to a duty of confidentiality. We will notify you of any suspected data security breach where legally required to do so.

13. Automated Decision-Making

You will not be subject to decisions that have a significant impact on you based solely on automated decision-making. The AI-assisted note-taking tool described in section 7 does not make decisions about your application. Other automated tools may form a proportionate part of our recruitment process (for example, to screen candidates against minimum requirements or assess test results). If you believe a decision affecting your application has been made solely by automated means, you have the right to request human review, express your point of view, and contest the outcome — contact privacy@xyzreality.com.

14. Complaints

You have the right to lodge a complaint at any time with the Information Commissioner’s Office (ICO) — website: ico.org.uk; phone: 0303 123 1113; address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. We would appreciate the opportunity to address your concerns first; please contact us at privacy@xyzreality.com in the first instance.

15. Changes to This Notice

We may update this notice from time to time. The most recent version will be available on our website or provided during the recruitment process.