1. INTRODUCTION
Entrepreneurs First (“EF”, “us”, “we”, “our”) are committed to protecting your privacy and meeting our legal obligations when you apply for a position or you (or an agent acting on your behalf) share your employment details with us.
This privacy notice explains what personal data we collect and use relating to employment and associated candidates (“you”, “your”) during our recruitment process. EFOL is a limited company registered in England and Wales under registration number 09064488, with its registered office at Senna Building, Gorsuch Place, London, E2 8JF. EFIM is a Limited Liability Partnership, registered under company number OC397263, authorised and regulated by the Financial Conduct Authority (FRN 807367), with its registered office at International House, 64 Nile Street, London, N1 7SR.
We are registered with the UK’s supervisory authority, the Information Commissioner’s Office (the “ICO”), for the processing of Personal Data under the following registration numbers: ZA078280 for EFOL and ZA123384 for EFIM
As an information-led business, we place great importance on ensuring the quality, confidentiality, integrity, and availability of the data we hold, and in meeting our data protection obligations where we process personal data. We are committed to protecting the security of your personal data. We use a variety of technical and organisational measures to help protect your personal data from unauthorised access, use or disclosure.
We update this privacy notice from time to time in response to changes in applicable laws and regulations, to our processing practices and to products and services we offer. When changes are made, these will be noted in the document control section.
2. PERSONAL DATA WE COLLECT
Personal data refers to any information that identifies or can be used to identify an individual. This does not include anonymous data, where all identifiable information has been removed. We also collect ‘special category personal data’, which is more sensitive and requires a higher level of protection, see the section below for further detail.
When you apply for a position, whether as an employee, consultant or as an advisor, or submit your CV (or similar employment information) to us, whether directly or through an agency, or attend an interview in person or by remote means, we will collect your personal data. This includes but is not limited to:
- Name and contact details (address, mobile phone number and email address)
- Company details (where applicable)
- Date of birth and gender
- Work history and employment positions held
- Salary, other compensation, and benefits information
- Nationality / visa / work permit information (where applicable)
- Academic and professional qualifications, education, and skills
- Photographs you may submit with your application
- Demographic information
- Records we create during interviews or correspondence with you
- Results of pre-employment screening checks such as references or DBS checks (where applicable)
- Any other information you choose to give us
Please note, when we receive references, we do so on a confidential basis. As a result, we would never provide you with a copy of your reference from a referee.
We may also collect special category data in accordance with the Equality Act 2010. We will only do this, for example, to make reasonable adjustments to enable all candidates to apply for vacancies, attend interviews and to commence employment. This is also necessary to ensure we meet our legal obligations when recruiting.
3. PURPOSES AND BASES FOR USING YOUR PERSONAL DATA
We will process your personal information for the following purposes and under the following lawful bases:
| Purpose | Lawful Basis for Processing |
|---|---|
| To assess your suitability for the role | Processing is necessary for taking steps to enter into a contract with you or for the performance of our contract with you (Article 6(1)(b) of the UK GDPR)
For special category data collected during the assessments, the additional basis that we rely on relates to our obligations in the field of employment and the safeguarding of your fundamental rights (Article 9(2)(b) of the UK GDPR and Schedule 1 Part 1(1) of the DPA 2018) |
| To make reasonable adjustments for you during the interview process and comply with our legal obligations under the Equality Act 2010 | Processing is necessary for us to comply with our legal obligations (Article 6(1)(c) of the UK GDPR)
For special category data, the additional basis that we rely on relates to our obligations in the field of employment and the safeguarding of your fundamental rights (Article 9(2)(b) of the UK GDPR and Schedule 1 Part 1(1) of the DPA 2018) |
| To conduct pre-employment screening checks including checking your identity and your right to work in the UK | Processing is necessary for us to comply with our legal obligations (Article 6(1)(c) of the UK GDPR)
For special category data, the additional basis that we rely on relates to our obligations in the field of employment and the safeguarding of your fundamental rights (Article 9(2)(b) of the UK GDPR and Schedule 1 Part 1(1) of the DPA 2018) |
| To contact unsuccessful applicants about future suitable vacancies | Processing is necessary for our legitimate interest of searching for suitable candidates for future vacancies based on their skills set out in the records we hold on candidates (Article 6(1)(f) of the UK GDPR) OR we will carry out this processing where you have consented to us retaining your data and contacting you about future vacancies based on the skills set out in the records we hold about you (Article 6(1)(a) of the UK GDPR). |
4. SENSITIVE PERSONAL DATA
We will only process “special categories” of sensitive personal data when we meet one of the legal conditions required to do so. This includes complying with legal obligations or exercising specific rights in the field of employment law. In rare cases, we may ask for your explicit consent to process such data.
We typically process special category data related to your physical or mental health, or disability status, to ensure workplace health and safety, assess fitness for work, provide necessary adjustments, manage sickness absence, and administer benefits.
5. SHARING OF YOUR INFORMATION
We may share your data with service providers and suppliers who process data on our behalf. In these cases, they act as data processors and are only permitted to use the data according to our instructions and not for any other purpose. These responsibilities, along with other obligations, are outlined in contracts between EF and the service providers or suppliers.
Your personal data may be processed outside the UK. When this occurs, we ensure that your data has a level of protection equivalent to that provided in the UK by:
- Ensuring the data is processed in a country recognised by the UK Secretary of State as having adequate protection (an adequacy regulation); or
- Entering into an International Data Transfer Agreement (“IDTA”) with the receiving organisation and applying supplementary measures, where necessary. A copy of the IDTA can be found here.
Within EF, your personal data will only be shared with those who need access to it, primarily the People and Finance teams, as well as hiring managers.
6. HOW LONG WILL WE RETAIN YOUR INFORMATION?
We will retain your personal data only for as long as necessary for the recruitment process. If your application is successful and you are hired, your data will be processed and retained according to our employee privacy notice, which will be provided with your employment documentation.
If your application is unsuccessful, we will retain your CV, application details, and interview notes for 12 months from the date we notify you of our decision. In some cases, we may ask if you would like us to retain your details in our talent pool, allowing us to proactively contact you if a suitable vacancy arises. If you agree, we will keep your data for this purpose. However, if you would like your records deleted before the 12-month retention period ends, please let us know, and we will do so.
In rare cases, we may need to retain your personal data for longer than 12 months if it is necessary to comply with legal obligations or in relation to legal claims.
7. YOUR RIGHTS
Individuals whose personal data we process have the following rights:
- Right of access: You have the right to access your personal data and can request copies of it, along with details about how we process it.
- Right to rectification: If the personal data we hold about you is incorrect or incomplete, you can ask us to correct or update it.
- Right to withdraw consent: Where we are using your personal data with your consent, you can withdraw that consent at any time.
- Right to object: If we are processing your personal data based on legitimate interests, you can object to this, unless we can demonstrate that our legitimate grounds override your rights.
- Right to restrict processing: In certain circumstances, you can ask us to limit the processing of your personal data.
- Right to data portability: You can request a machine-readable copy of your personal data to transfer to another service provider.
- Right to erasure: You can request that we erase your personal data, subject to certain conditions.
You generally will not need to pay a fee to exercise your rights. However, if your request is unfounded or excessive, we may charge a reasonable fee or refuse to comply with the request. We may request additional information to verify your identity. We aim to respond within one month of receiving your request, although complex cases may take longer, in which case we will keep you informed.
To exercise your rights, or contact our DPO please contact us at: [email protected] or write to us at:
Entrepreneurs First
Senna Building
Gorsuch Place
London
E2 8JF
Last updated May 2025