Who we are
Carefour Services Ltd is the data controller responsible for your personal information. This means we decide how and why your information is processed.
Registered company number: 10132155
Registered address: Brook House, Hartlebury Trading Estate, Hartlebury, Kidderminster DY10 4JB
ICO registration (data protection fee) number: ZA232017
Data Protection Officer: dpo@carefour.co.uk
Telephone: 01905 699699
We are registered with the UK Information Commissioner’s Office (ICO) and process personal data in accordance with the UK GDPR, as amended by the Data (Use and Access) Act 2025, and the Data Protection Act 2018.
What information do we collect?
We may collect and process the following personal information:
- Identity and contact details, including your name, email address and telephone number.
- Demographic information, such as your postcode.
- Website usage information, including the pages you view, the links you click and how you navigate our site.
- Communications, including information you provide when you contact us, complete an online form or correspond with us.
- Technical and cookie data, including your IP address, browser type, device information and information collected through cookies and similar technologies.
We collect most of this information directly from you. Some technical information is collected automatically when you use our website. Information about job applicants is explained in the Recruitment and job applicants section below.
How and why do we use your information?
Under data protection law, we must have a valid lawful basis for using your personal information. We use your information for the following purposes:
| Purpose | Lawful basis under Article 6 UK GDPR |
|---|---|
| Provide information, products or services you request. | Contract or steps at your request before entering into a contract, where applicable (Article 6(1)(b)). |
| Respond to your enquiries and communications. | Legitimate interests in responding to people who contact us (Article 6(1)(f)). |
| Improve our website and services. | Legitimate interests in developing and improving our business (Article 6(1)(f)); consent for non-essential cookies (Article 6(1)(a)). |
| Provide a more personalised website experience. | Consent for non-essential cookies (Article 6(1)(a)); legitimate interests where consent is not required and processing is appropriate (Article 6(1)(f)). |
| Send marketing messages about products or services that may interest you. | Consent (Article 6(1)(a)). |
| Protect our website and detect or prevent fraud and security issues. | Legitimate interests in security and fraud prevention (Article 6(1)(f)). A recognised legitimate interest is used only where a relevant statutory condition is met (Article 6(1)(ea)). |
| Comply with legal and regulatory obligations. | Legal obligation (Article 6(1)(c)). |
Where we rely on legitimate interests, we consider the effect on your rights and freedoms. Where we rely on consent, for example for marketing, you can withdraw that consent at any time.
We will not share your personal information with third parties for their own marketing purposes without your explicit consent.
Recruitment and job applicants
If you apply to work with Carefour, we process personal information necessary to manage your application and assess your suitability for the role.
Information we may use
- Your name and contact details.
- Your application, CV, employment history, qualifications, training and experience.
- Information provided in application forms, interviews and assessments, including interview notes and assessment results.
- Your availability and other information relevant to the role.
- References and previous employment information.
- Evidence of your identity and right to work in the UK.
- Driving licence or vehicle information where relevant to the role.
- Information needed for pre-employment checks, including relevant health or disability information where lawful, for reasonable adjustments or fitness-for-work assessment.
- Where appropriate and legally permitted, criminal convictions or offences information and Disclosure and Barring Service (DBS) checks.
Where recruitment information comes from
We may obtain information directly from you and, where appropriate, from recruitment platforms or agencies, referees, previous employers, the Disclosure and Barring Service, identity and right-to-work checking services, occupational health providers and other organisations involved in the recruitment process.
We collect only information relevant and necessary for the role and the stage of recruitment. If information is needed for a legal requirement or to progress your application, we will explain this; without it, we may be unable to continue your application or make an appointment.
Our lawful bases for recruitment
- Article 6(1)(b): taking steps at your request before entering into an employment contract, including managing your application and considering an offer.
- Article 6(1)(c): complying with legal obligations, including right-to-work checks and applicable safe recruitment requirements.
- Article 6(1)(f): our legitimate interests in assessing suitability and recruiting and managing a safe, suitable workforce, where these are not overridden by your rights and freedoms.
Special-category information and criminal-offence data
Some recruitment information, such as health or disability information, is special-category personal data. We process it only where necessary and where an additional condition under Article 9 UK GDPR applies.
Where applicable, we rely on Article 9(2)(b) and Schedule 1, Part 1, paragraph 1 of the Data Protection Act 2018 for employment law obligations and rights, including reasonable adjustments. For lawful occupational health or fitness-for-work assessments, Article 9(2)(h) and Schedule 1, Part 1, paragraph 2 may apply, subject to the required confidentiality safeguards.
Criminal-offence information is subject to Article 10 UK GDPR. We only process it where authorised by UK law and an applicable Schedule 1 condition is met, such as paragraph 1 for employment law obligations or paragraph 18 for safeguarding children and individuals at risk, where its requirements are satisfied. DBS checks will be appropriate to the role and limited to the level of check we are legally entitled to request.
We apply the safeguards required by the relevant condition, including an appropriate policy document where required, restricted access and secure handling. We will explain any different additional condition if it applies to your recruitment information.
Use of technology and AI in recruitment
Carefour may use approved digital, automation or AI-assisted tools to support parts of the recruitment process, such as managing applications, communicating with candidates, organising information or assisting with initial screening.
These tools support our recruitment team; they do not remove Carefour’s responsibility for recruitment decisions. Appropriate, meaningful human oversight will be maintained. Staff reviewing recommendations must be able to question them and change the outcome. Significant employment decisions will not be based solely on AI-generated recommendations where doing so would be inappropriate or unlawful.
Candidates may contact dpo@carefour.co.uk for further information about how their personal information has been processed during recruitment, or to raise a concern about an AI-assisted assessment. The general AI safeguards in the next section also apply.
Artificial intelligence and automated tools
Carefour may use approved artificial intelligence (AI), automation and digital tools to assist with administrative activities, recruitment, quality assurance and the delivery and management of our services.
AI is used to support our staff, not to replace appropriate human judgement or decision-making. We do not permit significant decisions about individuals to be made solely by an AI system where this would be inappropriate or unlawful.
Where an approved AI system processes personal information, its use must comply with Carefour’s data protection, information governance, confidentiality and AI governance requirements. We assess relevant systems before approval and apply appropriate security, access and data protection controls.
Where the use of AI materially affects how your personal information is processed or how a service is provided to you, we will provide appropriate information about that use. You may contact dpo@carefour.co.uk if you have questions about Carefour’s use of AI and your personal information.
Where required by law, we will provide additional information about automated decision-making and the safeguards available to you, including the ability to make representations, obtain human intervention and contest a significant automated decision.
Who do we share your information with?
We do not sell your personal information. We may share it with:
- Service providers and suppliers who process information on our behalf, such as IT, hosting, email, payment, recruitment-system or website analytics providers. These providers act on our instructions under a written contract and may only use your information as we direct.
- Organisations involved in necessary recruitment checks, including referees, previous employers, DBS, identity and right-to-work checking services and occupational health providers, where appropriate and lawful. Some of these organisations act as independent data controllers.
- Professional advisers, such as accountants, auditors or legal advisers, where necessary.
- Authorities, regulators or law enforcement where required by law, or where lawful and necessary to protect our rights, property or safety.
- Successors in the event of a business sale or reorganisation, where personal information may be transferred to the new owner subject to appropriate protection.
We only share information that is necessary and appropriate for the purpose.
International transfers
Carefour seeks to use systems and service providers that provide appropriate protection for your personal information. Some of the organisations that provide technology or other services to Carefour may process or store personal information outside the United Kingdom.
Where personal information is transferred outside the UK, Carefour will ensure that the transfer is permitted under UK data protection law and that appropriate safeguards are in place. Depending on the destination and circumstances, these may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved Standard Contractual Clauses, or another legally recognised safeguard.
You can contact us at dpo@carefour.co.uk if you would like further information about safeguards applying to an international transfer of your personal information.
Cookies and similar technologies
Our website uses cookies and similar technologies to make the site work, remember your preferences and understand how the site is used.
- Essential cookies are necessary for the website to function and do not require your consent.
- Non-essential cookies, such as analytics and personalisation cookies, are only set with your consent. You can give or withdraw consent through our cookie banner and manage cookies through your browser settings.
For full details of the cookies we use, please see our Cookie Policy at carefour.co.uk/cookie-policy/.
How do we keep your information secure?
We take appropriate technical and organisational measures to keep your personal information secure and prevent unauthorised access, loss, misuse or disclosure. We limit access to those who have a genuine business need to know it, and require them to keep it confidential.
No method of transmission over the internet is completely secure, but we work to protect your information and to respond appropriately if a security incident occurs.
How long do we keep your information?
We retain personal information only for as long as necessary for the purpose for which it was collected and in accordance with Carefour’s Records Retention Schedule. Different categories of information have different retention periods, taking account of relevant legal, regulatory and contractual requirements.
Recruitment records relating to unsuccessful applicants will be retained for the period specified in our Recruitment and Records Retention procedures and then securely deleted or anonymised, unless we have obtained permission to retain an applicant’s details for consideration for future vacancies. If you give that permission, we will explain the retention period and how to withdraw it.
Relevant records for successful applicants become part of their employment record and are retained in accordance with our Records Retention Schedule. When information is no longer required, we securely delete or anonymise it.
You may contact dpo@carefour.co.uk if you would like information about the retention period applying to a particular category of your personal information.
Your rights
Under data protection law, you have rights in relation to your personal information. Depending on the circumstances, these include:
- Being informed about how your personal information is used.
- Access: request a copy of your personal information through a subject access request.
- Rectification: ask us to correct or update inaccurate or incomplete information.
- Erasure: ask us to delete your personal information in certain circumstances.
- Restriction: ask us to limit how we use your information in certain circumstances.
- Objection: object to certain processing, including direct marketing.
- Data portability: where applicable, ask us to provide or transfer information you supplied in a structured, commonly used, machine-readable format.
- Withdrawal of consent: withdraw consent at any time where we rely on it, without affecting the lawfulness of processing before withdrawal.
- Automated decision-making safeguards: where applicable, receive information, make representations, obtain human intervention and contest a significant automated decision.
Some rights are subject to legal conditions or exemptions. For example, we may need to retain information to meet a legal obligation. You can opt out of marketing at any time using the unsubscribe link in a marketing email or by contacting us.
To exercise your rights, contact dpo@carefour.co.uk. We may need to confirm your identity. We will respond without undue delay and normally within one month. If the law allows extra time or we need information to confirm your identity or clarify your request, we will explain this. Exercising your rights is free of charge in most cases.
Complaints
If you have a concern about how we handle your personal information, please contact our Data Protection Officer at dpo@carefour.co.uk, by telephone or by post using the contact details in this notice. We would like the opportunity to resolve your concern. You have the right to ask us to deal with your complaint.
We will acknowledge your complaint within 30 days, investigate it without undue delay, keep you informed about progress and let you know the outcome.
You also have the right to complain to the UK’s independent data protection regulator, the Information Commissioner’s Office (ICO). You can contact the ICO at any time, including if you are not satisfied with our response:
Information Commissioner’s Office
Website: ico.org.uk/make-a-complaint/
Helpline: 0303 123 1113
Post: ICO Head Office, 4th Floor, No.3 Circle Square,
5 Hawkshaw Street, Manchester M1 7BL
Changes to this privacy notice
We may update this notice from time to time. Changes will be posted on our website with a revised Last updated date. Where changes are significant, we will take reasonable steps to bring them to your attention.
Contact us
If you have questions or concerns about this notice or how we handle your personal information, please contact:
Data Protection Officer
Carefour Services Ltd
Brook House, Hartlebury Trading Estate
Hartlebury, Kidderminster DY10 4JB
Telephone: 01905 699699
Email: dpo@carefour.co.uk
Please tell us if you require this information in another format or need support to understand it.
