Version	1.1	Effective date	October 2026
Classification	PUBLIC	Document owner	Company Management
Review	September 2027	ICO registration	ZB441034
Company number	13521468	Contact	team@ki-sl.co.uk

 

1. Who we are

Controller	KI Sound & Light Ltd
Company number	13521468
Address	46 East St, Braintree, CM7 3JJ, United Kingdom
Email	team@ki-sl.co.uk
ICO registration	ZB441034
Responsibility	Company Management

2. Scope

This notice applies to people who apply for employment with KI Sound & Light, participate in recruitment/interviews, are considered for a role, or provide a reference. It applies whether or not the applicant is appointed.

3. Information we collect

• name, address/general location and contact details;
• CV, cover letter/application information, employment history, qualifications and experience;
• interview information, scoring and interviewer notes;
• availability and other information relevant to suitability;
• references for successful applicants;
• right-to-work evidence for successful applicants; and
• special category information only where genuinely necessary, for example information required to consider a reasonable adjustment.

We do not routinely require criminal-record information or DBS checks. If a check becomes necessary for a particular role, we will inform the applicant before obtaining the information, identify the relevant lawful basis and condition under the Data Protection Act 2018, and collect only information that is necessary and proportionate for the role.

We ask applicants to provide only information that is relevant to the recruitment process. Applicants should avoid including unnecessary sensitive information in a CV or application. Where information is required to progress an application, failure to provide it may prevent KI Sound & Light from assessing the application, verifying suitability or completing required pre-employment checks.

4. Sources

We normally receive applicant information directly from the applicant or through Indeed. We may also receive relevant information from referees, recruitment advisers, publicly available professional sources, right-to-work checking services and, where applicable, a person or organisation that has introduced the applicant. We will tell applicants where information has been obtained indirectly where data protection law requires us to do so.

CVs may be downloaded temporarily and printed for interview use. Relevant interview and selection notes are scanned to secure company storage and temporary paper copies are securely shredded. References and right-to-work information are normally obtained only after a successful application or conditional offer. We take reasonable steps to ensure that information used to make recruitment decisions is accurate, relevant and limited to what is necessary.

5. Purposes and lawful bases

Processing	Lawful basis
Recruitment administration and assessment	Article 6(1)(b), where processing is necessary to take steps at the applicant’s request before entering into an employment contract; Article 6(1)(c), where processing is necessary to comply with a legal obligation; and Article 6(1)(f), where necessary for KI’s legitimate interests in administering recruitment, assessing suitability and maintaining appropriate recruitment records.
Retention of selection records	Article 6(1)(f) legitimate interests in demonstrating fair recruitment and responding to claims
References	Article 6(1)(b), where necessary in connection with steps before entering into an employment contract, and/or Article 6(1)(f), for KI’s legitimate interests in verifying suitability and making informed recruitment decisions. References are normally sought only after a successful application or conditional offer.
Right-to-work checks	Article 6(1)(c) legal obligation
Special category data needed for employment/reasonable adjustments	Article 6(1)(c), where processing is necessary to comply with employment or equality law, or Article 6(1)(f) where another appropriate and documented purpose applies; together with Article 9(2)(b) and Schedule 1 Part 1 paragraph 1 of the Data Protection Act 2018 where processing is necessary for employment, social security or social protection obligations and rights. Any other Article 9 condition will be identified and documented before processing begins.

KI does not rely on consent where an applicant has no genuine choice or where consent would not be appropriate because of the recruitment relationship. If consent is used for an optional and clearly defined purpose, it may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.

Where KI relies on legitimate interests, it records the purpose, confirms that the processing is necessary, considers the effect on the applicant and documents the balancing assessment. The assessment is reviewed if the purpose, information used or circumstances materially change.

6. Automated decision-making

Recruitment decisions are made by people. KI does not currently use solely automated decision-making to shortlist, interview or appoint candidates.

7. Storage and recipients

• Indeed, where applications are submitted through that service;
• Microsoft 365 for recruitment correspondence and internal communications;
• secure company systems and storage used for retained interview and selection records;
• Company Management and employees who require access for recruitment, business administration, information security or legal compliance;
• an HR consultant or other professional adviser where advice is genuinely required;
• referees following a successful application or conditional offer;
• Home Office or right-to-work checking services where necessary;
• IT, hosting, security, document-management and secure-destruction providers acting under appropriate contractual and confidentiality requirements; and
• regulators, courts, law-enforcement bodies or other organisations where disclosure is required or permitted by law.

Access is granted according to role and business need. External providers that process personal information on KI’s behalf must be subject to appropriate data-protection terms and proportionate assurance checks. They may use the information only for agreed purposes and must protect it appropriately.

KI aims to store recruitment information in the United Kingdom or in locations covered by UK data-protection law. If a service provider processes information outside the United Kingdom, KI will ensure that an appropriate transfer mechanism and relevant safeguards are in place, such as UK adequacy regulations or approved contractual safeguards. Further information about a relevant safeguard is available on request.

8. Retention

Record	Retention
Unsuccessful selection/interview records	12 months after completion of the recruitment exercise, then securely deleted.
Downloaded CV files	Deleted promptly after the recruitment decision and after any information genuinely required for the formal recruitment/workforce record has been transferred.
Printed CVs/temporary paper copies	Securely shredded promptly after the recruitment decision and any authorised transfer to the formal record.
Successful applicant information	Relevant information transferred to the workforce record; unnecessary recruitment copies deleted.
Right-to-work evidence	For the duration of employment and 2 years after employment ends, then securely destroyed.

Retention periods may be extended where information must be preserved for an active complaint, legal claim, regulatory enquiry, investigation or litigation hold. In those circumstances, access will remain restricted and the information will be securely deleted when the additional purpose has ended. KI periodically reviews retained recruitment information and securely disposes of records that are no longer required.

9. Security

Recruitment information is protected through proportionate technical and organisational measures. These include restricted and role-based access, individual user accounts, strong authentication and multi-factor authentication where applicable, secure company storage, controlled use of privileged or administrative access, secure paper storage and destruction, and deletion of temporary downloaded files.

KI reviews access permissions periodically and when responsibilities change. Access is removed promptly when a person leaves the organisation or no longer requires it. Where technically and operationally appropriate, KI restricts bulk downloads, copying and transfers to personal email accounts or unmanaged devices. Audit logs, security alerts and system reviews may be used to identify unusual or unauthorised activity. Suspected misuse or loss of information is escalated, investigated and documented under KI’s incident-response arrangements.

Employees, contractors and advisers with access to recruitment information are required to follow relevant confidentiality, acceptable-use, information-security and data-protection requirements. Access is limited to people who need the information for recruitment, business administration, information security, legal advice or compliance.

10. Rights and complaints

Applicants may have rights to request access to their personal information, correction of inaccurate or incomplete information, erasure, restriction of processing, objection to processing based on legitimate interests, and receipt or transfer of information where the right to data portability applies. Rights are not absolute and may be limited where an exemption or other lawful reason applies.

Where processing is based on legitimate interests, an applicant may object by explaining their particular circumstances. KI will stop the processing unless it can demonstrate compelling legitimate grounds or the information is required for the establishment, exercise or defence of legal claims.

Requests and data-protection complaints can be sent to team@ki-sl.co.uk. KI may ask for information needed to verify identity or clarify a request. Rights requests will normally be answered within one month, subject to any lawful extension. Complaints will be acknowledged promptly, investigated appropriately and answered without undue delay.

Applicants also have the right to complain to the Information Commissioner’s Office. Information is available at www.ico.org.uk, or the ICO can be contacted by telephone on 0303 123 1113. KI would welcome the opportunity to address a concern directly before it is referred to the ICO, but this does not affect the right to complain to the regulator.

11. Changes

We review this notice periodically and following material changes to recruitment practices, systems, service providers, legal requirements, regulatory guidance or identified risks. The current version and effective date will be displayed when the notice is published. Material changes will be brought to applicants’ attention where appropriate.