Ocado Retail Ltd Recruitment Privacy Notice
Recruitment Privacy Notice
Ocado Retail Limited (“Ocado Retail”, "we", "us" or "our") is committed to protecting your privacy and the personal data entrusted to us in line with data protection laws and regulation applicable to the United Kingdom, including the UK General Data Protection Regulation (GDPR), Data Protection Act 2018 (DPA) and EU GDPR.
This Privacy Notice sets out the ways in which we process, share, retain and protect your information, alongside your rights as the data subject, and how you can raise a complaint if you feel we have not treated your personal data responsibly.
This Privacy Notice is applicable to applicants and potential employees of Ocado Retail. This includes the graduate recruitment scheme. Those who succeed through the application or graduate process will then be subject to the Ocado Retail Employee Privacy Notice
Terms and definitions within this Notice:
“Controller” is defined as the organisation making the decision as to how the information is processed and for what purpose.
“Joint Controller” is defined as two or more controllers who collectively decide how the information is processed and for what purpose.
“Personal data” is any information that alone, or in combination with other information, can directly/indirectly identify a living individual. This also consists of “special categories of information” which, due to its personal nature, requires further protection when processed.
“Processing" means any action undertaken on the personal data, by manual or automated means, including but not limited to collecting, recording, organising, storing, changing, accessing, using and disclosing.
“Processor” is the organisation undertaking the processing on behalf of the controller.
“Profiling” is the activity of processing personal data via automated means to analyse and make predictions about the individual.
Personal data
Personal Data is any information relating to a living individual who can be identified directly or indirectly, often by name, customer number, location, an online identifier or other factors specific to their identity.
Personal Data may include “special category data” such as Personal Data relating to racial or ethnic origin, political opinions, religious beliefs, membership of a trade union, physical or mental health, and criminal records and allegations.
Types of data we may process on you includes but is not limited to:
- Personal details: Name, gender, date of birth, marital status / title, nationality, address, personal email address, contact number, national insurance number
- Eligibility to work details: Copies of passport or other identification, visa(s), birth certificate, marriage certificate(s), change of name, citizenship, National Insurance Number
- Recruitment information: Pre-employment checks such as previous employment, military service, references, curriculum vitae, qualifications, socio-economic background checks
- Performance records: Interview notes, internal feedback, aptitude test results, video recordings
- Public profile: Information from public sources related to your professional experience, such as LinkedIn or the website of your current employer.
- Device and Technical Information: IP address, browser type and version, session behaviour, URL(s) visited, traffic source, geographical location and device settings.
Special category data and criminal offence data relates to sensitive types of personal information that require a higher level of protection. The types of information we may collect and process includes, but is not limited to:
- Personal information: Race, ethnicity, religious beliefs, trade union membership
- Health data: Disabilities, parental reliance
- Criminal Offences / Convictions: Pending prosecutions, Criminal Convictions, Driving offences or employment offences
Sources of data
Most of the personal information Ocado Retail processes is provided by you or a recruitment agency working on your behalf via:
- Your CV
- Application forms
- Emails
- Communications (electronically, telephone or face to face)
- Interviews Aptitude tests
- Identification documents, such as driving licence or passport
- Publicly available sources such as your LinkedIn profile or other social media platforms
- Other recruitment sources
- Personal information sources such as third party platforms and surveys
- Information provided by references
Purposes of processing
We process the majority of your personal information for the primary purpose of recruitment and related administration as well as enabling us to comply with our legal obligations. Prior to a recruitment decision being made we may also process your personal information, where relevant, in order for us to consider your application in the context of your socio-economic background as well as monitoring equal opportunities.
Further details surrounding our purposes of processing can be located within the Lawful Basis of Processing section.
Lawful basis of processing
The lawful basis we rely upon to process your Personal Data may differ for each Processing activity. Dependent upon the purpose for Processing as detailed below, one of the following lawful basis of processing may apply:
- Article 6, 1, (a) GDPR - Consent has been provided. This may include:
- Recruitment checks (where applicable
- Processing of health data (where applicable)
- Employment history validation
- Graduate recruitment / socio-economic assessments
- Article 6, 1, (b) GDPR - To prepare for the contract of employment. Such as:
- Recruitment interview process
- Identity verification
- Employment history validation
- Education and qualification history
- Account creation and employee directories
- Article 6, 1 (c) GDPR - Compliance with a legal obligation. This may include:
- Compliance with employment laws
- Confirming eligibility to work in the UK, in line with immigration laws
- Identity verification
- Disclosure and Barring Service (DBS) checks
- Credit and sanctions checks
- Article 6, 1, (f) GDPR - Pursuant to our, or a third parties, legitimate interests. This may include:
- Communication and engagement
- Recruitment and role suitability
- Conduct and capability checks
- Network and information security
- Data analytic studies (recruitment trends)
For information defined as ‘special category’ Ocado Retail relies upon the following lawful basis for processing:
- Article 9, 2, (f) GDPR - Establishing, exercising or defending a legal claim. This may include:
- Litigation against the business
- Fraud prevention and investigation
- Schedule 1, Part 1, (1) DPA 2018 - Performing or exercising obligations in connection with employment. This may include:
- Health assessments to comply with the Equality Act 2010
- Schedule 1, Part 2, (8) DPA 2018 - Equality of opportunity. This may include:
- Equal opportunities and diversity monitoring and reporting.
We may also process criminal conviction data reliant upon:
- Schedule 1, Part 3, (33) DPA 2018 - Legal Claims. This may include:
- Legal or potential legal proceedings, obtaining legal advice or establishing, defending and / or exercising legal rights.
We may collect and process your personal data for humanitarian purposes, such as the monitoring of epidemics and their escalated spread (Recital 46) and in compliance with those purposes as defined by the appropriate authority/government under the lawful basis of “public interests.” This information will only be provided to us by you.
Automated Decision Making and Profiling
Automated Decision Making is when a decision about your application is made by a computer without human intervention.
We may rely solely on automated systems and Profiling to evaluate your application and suitability for the role being applied for.
Under the UK GDPR, you have specific rights if a decision made solely by automated means has a legal or similar effect on you:
- The Right to Human Intervention: You can request that one of our recruitment team members reviews an automated decision.
- The Right to Contest: You have the right to express your point of view and challenge the outcome of an automated decision.
- How to Exercise These Rights: To request a manual review or contest a decision, please contact us at careers@ocadoretail.com.
Sharing Data
Only information necessary for the provision of a service is provided to third parties, this may include:
- Agenda screening services (for pre-employment checks such as qualification verification, credit reference checks, right to work etc.);
- Recruitment companies (including for the purposes of screening, background and criminal records checks);
- Formally contracted service providers to support, maintain and host information systems;
- Internal employees for the purpose of the recruitment process;
- Legal and professional advisors relating to legal and financial obligations as an advisor or in the course of a disciplinary or court orders;
- Occupational health providers for the capacity of working to be assessed;
- Her Majesty’s Revenue and Customs for tax purposes;
- Home Office for immigration purposes.
We may also share information about you, if required legally, to prevent harm, financial or loss reputational damage for the investigation of suspected or actual fraudulent or illegal activities.
International Transfers
Our operations are based in the UK and the Personal Data that we collect from you is processed, stored, and used within the UK and other countries such as the European Economic Area (EEA).
For any transfer of Personal Data outside the UK or EEA namely third party territories, we aim to apply a similar level of protection by following requirements set out in data protection legislation, such as ensuring the country has been granted adequacy status by the European Commission (and as considered by the UK Information Commissioner’s Office to offer an adequate level of protection for personal data) or including Standard Contractual Clauses as created by the European Commission.
We also have the ability to rely on the derogation under Article 49 of the GDPR (when the transfer relates to the performance of a contract and for your benefit), and where you provide permission for the transfer to go ahead.
Security
We maintain administrative, technical and physical safeguards designed to protect against accidental, unlawful or unauthorised destruction, loss, alteration, access, disclosure or use.
Access to personal data is restricted only to those who have a legitimate business need and data processed by third parties is only done so under strict instruction from Ocado Retail, as per the terms of their contract. We contractually require service providers and processors to safeguard the privacy and security of personal information they process on our behalf in line with data protection obligations and authorise them to use or disclose the information only as necessary to perform services on our behalf and under our instruction or to comply with legal obligations and requirements.
Retention
Information relating to recruitment is subject to a number of employment legislation and regulations which affect the duration for which information is retained.
We will normally delete your personal information within six months if you are not shortlisted for the role you applied for. If your application is unsuccessful after the shortlisting and interviewing stages we will hold your personal information on file in our management system for twelve months after the end of the relevant recruitment process.
We reserve the right to retain records of unsuccessful applicants for up to a period of two years, with the view of considering you for future vacancies. You have the right to refuse this and request your information is removed from our database.
If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your personnel file and retained during your employment. Details regarding how your information is processed in relation to employment purposes are provided in a separate notice following acceptance of a job offer.
Rights
You can exercise certain rights in regards to the data we hold on you:
- The right to receive a copy of the information we hold about you
- The right to have inaccurate information corrected or incomplete information completed
- The right to have your information erased
- The right to have the processing of your information restricted
- The right to withdraw your consent or object to processing reliant upon legitimate interests
- The right to have your information transferred to another organisation or yourself in a machine readable format
- The right to request human intervention in regards to automated decision making
The applicability of these rights is dependent upon our purpose and the lawful basis of processing relied upon. There may be reasons why the above rights may be limited in some circumstances. For example, we can refuse to provide information if fulfilling your request would reveal Personal Data about another person, or if you ask us to delete information which we are required to retain by law, have compelling legitimate interests to keep, or need to access in order to fulfil our legal obligations. In such situations, we would only use your information for these purposes and not use or share your information in other ways. We will always protect your privacy and retain any Personal Data in accordance with the section entitled 'Retention'.
How to exercise your rights and timescales
You can exercise your rights either verbally or in writing. However, if you submit a request verbally we recommend that you follow this up in writing to provide a clear correspondence trail.
We have an obligation to respond within one month of receiving your request. However, we also have the ability to extend the response time by two months should we determine the request is complex and requires additional time and resources to respond. If this is the case you will be informed of the extended response date, alongside an explanation, within the original one-month time frame.
The quickest and easiest way to make a data subject right request is to email careers@ocadoretail.com. You can also email us if you have any questions, comments or concerns about how your personal data has been handled.
Lodging a complaint
If you wish to exercise your rights, raise a query or concern, report a breach or make a complaint you can contact us at privacy@ocadoretail.com. We may then transfer your request or complaint to the applicable team.
If you are not satisfied with our use of your Personal Data or our response to any request made by you in relation to your Personal Data, you have a right to make a complaint to the Information Commissioner at:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Tel: 0303 123 1113 (local rate) or 01625 545745 (national rate)
Email: casework@ico.org.uk
The ICO currently recommends you contact them within 3 months of your
last contact with us and advises you to contact them once the company's complaints process has been exhausted.
Version Control
This notice may be amended at any time to reflect changes in the way we process your information.
January 2026
