Recruitment Privacy Notice

Effective Date: 13^th October 2025

1. Introduction

Andrew Brownsword Hotels ‘ABH’ (referred to as “we” “our” or “us”) is committed to protecting your personal data in accordance with applicable UK data protection law; The UK GDPR, Data Protection Act 2018, Privacy and Electronic Communications Regulations 2003 (‘PECR’) and the Data (Use and Access) Act 2025. This also includes (and is not limited to) other applicable laws such as the EU GDPR and e-Privacy Directive.

This recruitment privacy notice is designed to inform applicants (including potential applicants) how the ABH Group processes personal data for recruitment purposes.

This recruitment privacy notice applies to the hotels that form part of our group:

Each hotel is a data controller and will act as a joint-data controller with our Central HR in Bath, and has been detailed further below.

2. Contact Information

Our Central HR contact details are as follows:
4 Queen Square
Bath, Somerset
BA1 2HA
United Kingdom
Email: hradmin@brownswordhotels.co.uk
Tel: +44(0)1225 320470

Contact information to each individual hotel can be found on their respective website.

The Data Protection Officer (DPO) for ABH is as follows:
Name: RA Data Protection Ltd
Email: ravi@radataprotection.com
Website: https://radataprotection.com

3. Lawful Basis

The lawful basis for us to process recruitment candidate data is based on:

Contractual obligation
Legal obligation
Vital interests
Our legitimate interests

We do not request consent however if we receive a request to delete candidate information we will be happy to respond to such requests where possible.

4. Data Subjects

For our recruitment process we may process the personal data of the following individuals (“data subjects”):

Enquirers
Applicants
Past unsuccessful applicants

5. Personal Data Collection

We advertise roles on our careers website and on other websites, including:

Adzuna
Caterer
Facebook
Google Jobs
Hospitality Jobs UK
Indeed
Job Centre
Leisure jobs
LinkedIn
Placed
Recruitment agency websites
Talent.com
The Staff Canteen
Zip Recruiter

The hiring manager and Central HR will be able to review data of applicants which can include the following sets of personal data:

Name
Contact details
Position applied for
Information within your CV
Information visible in your social media profiles (e.g. LinkedIn profile)
Answers to any application questions

There may be instances of where we may need to process special category personal data, for example health information to help us make any reasonable adjustments for any in-person interviews should we ever be informed. We don’t normally request such information but if we are informed of such information prior to confirmation of an interview we will be able to make any reasonable adjustments in advance. This data will also be held for as long as necessary in line with our data retention schedules.

Please also note applications made may enable hiring managers to view your social media profiles such as your LinkedIn profile, and view information not included on your CV.

6. WhatsApp Applications

On our main recruitment website applicants are able to voluntarily submit applications via a dedicated WhatsApp channel. The WhatsApp channel is administered and provided by our Applicant Tracking System (ATS) who have enabled this facility. The WhatsApp channel uses an automated system so there is no human intervention (i.e. no human chat interactions) and we can only view a chat conversation when an application has been submitted through the WhatsApp channel. The application process follows the same process as a website application and we will communicate with applicants via the ATS or contact information provided.

For further information please contact us using our details above.

7. How We Obtain Personal Data

During our recruitment process we may obtain personal data about candidates through various means, which include (but is not limited to):

Directly from the candidate
Candidates social media profile (e.g. LinkedIn profile)
Specified referees
Employee referrals
From third-party recruitment websites

8. How Is Your Personal Data Used?

Personal data processed as part of the recruitment process can include the following activities:

To assess your skills, qualifications, and suitability for the role
Carry out background and reference checks, where applicable
Communicate with you about the recruitment process
Keep records related to our hiring processes
Comply with legal or regulatory requirements
If successful offer suitable candidates’ contracts of employment

If you fail to provide information when requested, which is necessary for us to consider your application (such as evidence of qualifications or work history) we will not be able to process your application successfully.

Please also note as part of our recruitment process, we do not carry out any automated decision-making towards candidate suitability through means such as AI. If this is to change, we will update this notice as soon as possible.

9. Criminal Conviction and Offences Data

There may be roles within our Bath head office and hotels which may require a criminal background check due to the nature and purpose of their role. If any roles require a criminal background check we would carry out either a basic or enhanced check (again role dependant) and we keep that information in line with our retention schedules. For more information you can contact us using our information above.

10. Background and Reference Checks

Our hiring managers and/or Central HR will carry out background and reference checks (employment and right to work) with candidates as a condition of employment. Upon satisfactory checks being completed we will be able to conclude our onboarding process.

The personal data collected and processed will include (but is not limited to):

Name
Contact details
Employment history
Right to work documents
Drivers license (only applicable where driving for work is required).

For more information you can contact using our details as mentioned above.

11. Joint Data Controller and Data Sharing

As mentioned above each individual hotel is a data controller and will act as a joint-data controller with our Central HR in Bath for certain recruitment activities. This also means a variety of different team members may share data of applicants for a variety of activities such as referral information and if a candidate may be suited for a different hotel location other than the one they originally applied for.

The individual hotels who advertise specific job roles will make a decision on who to interview and hire, and Central HR in our Bath office will create specific employee files, carry out background and reference checks on the same employee with the same data originally gathered from the hiring hotel.

A shared recruitment database is used by the individual hotels and head office team to enable access and sharing where needed.

For more information you can contact us using our details above.

12. Third-Parties Who We May Share Personal Data With

We may receive application data through third-party websites as detailed above, but we do not use any third parties such as recruitment agencies.

We do not rent, sell or purchase any recruitment related personal data to and from other organisations.

Please note there may also be instances where we may need to share personal data with a competent law enforcement body, regulatory body, government agency, court, or other third party where we believe disclosure is necessary (i) as a matter of applicable law or regulation or (ii) to exercise, establish or defend our legal rights.

13. Data Transfers Outside the UK

We do not share or transfer any recruitment related data to other organisations outside the UK, but where we may be required to do so, we will ensure there is a legitimate purpose for the data transfer, it is documented where needed and the correct data transfer mechanism under data protection law is relied on. For more information you can contact us using our details below.

14. Data Retention

We will retain recruitment related personal data for as long as necessary in line with various requirements, such as for example, best practice recommendations (e.g. ICO recommendations), relevant guidelines (e.g. ACAS guidance) or for as long as mandated under specific legislation (e.g. Equality Act 2010). We will also determine appropriate retention periods based on our legitimate interests where identified. This includes both data controller and joint-data controller retention periods.

At the end of the retention period personal data will be securely deleted or anonymised.

15. Data Security

Across our hotel group, we have put in place appropriate security measures to prevent personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality. If we become aware of any loss, misuse, alteration of personal data we will investigate the incident at hand and report (when needed to relevant parties) such instances.

16. Data Subject Rights

Under data protection law individuals have the following rights:

Right to be informed
Right to access personal data
Right to rectify personal data
Right to erase personal data
Right to object to personal data
Right to have data ported
Right to restrict personal data
Right to not have personal data processed by automated means and profiled

If you would like to exercise any of the above rights you can do so by sending a written request using details above. Please note we may ask for ID (e.g. passport scan, drivers license etc) to verify identity where needed. Upon successful verification we will delete and remove all copies of ID received.

Should we also require extension of time to help fulfil any Right requests, we will be sure to contact requestors as soon as possible with reason(s) why an extension is needed and when Right requests can be fully carried out and completed.

17. Concerns and Complaints

If you have any concerns and/or complaints to this recruitment privacy notice and/or to how we process personal data for recruitment purposes please contact us using our details above.

You can make a complaint to the ICO (or other supervisory authority) at any time however, we hope that you would consider raising any issue or complaint you have with us first. You can submit a complaint to the ICO via https://ico.org.uk/make-a-complaint/.

18. Recruitment Privacy Notice Updates

We will review this notice and make changes to it from time to time. We recommend that you check this notice to see where changes have been made and to ensure you are able to review updated information at all times.