Processing of (personal) data by the entity in charge of the online application process
Candidate Privacy Notice
As the Data Controller, di:ga Communications is committed to protecting the privacy and security of candidates’ personal data. This privacy notice describes how we collect and use personal data about you during and after the recruitment process in accordance with UK GDPR and the Data Protection Act 2018.
Our philosophy and approach to your personal data is that we will do our best to:
1. comply with relevant data protection legislation and all other applicable laws;
2. be open and transparent about how we use your personal data;
3. only collect personal data that may be required as part of the recruitment process;
4. make sure you can access and exercise your other rights under relevant data protection legislation;
5. protect your personal data and keep it secure; and
6. train our staff on the importance of privacy and making them aware of the correct processes to follow in relation to privacy and the handling of personal data.
This notice applies to candidates that apply for advertised job vacancies with di:ga Communications. Where a role requires the successful candidate to have the right to work in the UK, evidence of this will be requested at the appropriate stage of the recruitment process. We are currently unable to sponsor work visas or provide immigration support. Where this requirement applies, it will be stated in the relevant job advertisement.
What Personal Data We Collect
We may collect and process:
Standard personal data:
- Contact details (name, address, phone, email)
- CV, cover letters, and application documents
- Work history, qualifications, references
- Right to work documentation (evidence of existing UK work authorisation) — required under the Immigration, Asylum and Nationality Act 2006.
- Video recordings and photographs submitted as part of a skills assessment or portfolio (for example, for digital or web development roles where this is relevant to evaluating technical or creative competence) – processed on the basis of legitimate interests (assessing candidate suitability) under UK GDPR Article 6(1)(f). Such material will be retained for the same period as other application data and will not be used for biometric identification purposes.
- Assessment results
Special category data (where necessary):
- Disability information (only to determine if reasonable adjustments are needed during the recruitment process)
- Equal opportunities monitoring data (processed separately and anonymously)
- Criminal convictions or cautions – only where a specific client contract, regulatory requirement, or applicable law requires this as a condition of the work, and a legal gateway for processing exists. Where a DBS check or equivalent is required, candidates will be informed at the point of application or at the relevant stage of the recruitment process.
How We Collect Your Data
Through application forms, CVs, correspondence, interviews, assessments, references from former employers, and background check providers (where required). On occasion, we may also collect data from publicly available professional profiles (such as LinkedIn) or from recruitment agencies where we approach candidates directly. Where this occurs, we will provide you with this privacy notice at the point of first contact.
Legal Basis for Processing
We process your data based on:
- Contractual necessity – to assess your suitability and enter into an employment contract
- Legitimate interests – to manage and progress active applications through our recruitment pipeline; schedule and coordinate interviews and assessments; communicate with candidates about their application; maintain records of recruitment decisions for consistency and audit purposes; retain details of strong unsuccessful candidates for up to 12 months for consideration for future suitable roles (to opt out of this at any time, contact us at privacy@digacommunications.com); verify information provided by candidates via references; and establish, exercise or defend legal claims including Employment Tribunal proceedings. We have considered our legitimate interests against your rights and interests and are satisfied that our processing is proportionate and does not override your fundamental rights.
- Legal obligation – to verify right to work and conduct required background checks
- Special category processing – under Schedule 1, Part 1 of the Data Protection Act 2018 (employment purposes) for disability and health information processed to comply with our employment law obligations, including making reasonable adjustments; and under Schedule 1, Part 2, paragraph 6 DPA 2018 for equal opportunities monitoring. Criminal records data is only processed where a specific legal gateway applies.
Your data is stored securely in our recruitment systems, HR databases, and email systems. We implement technical and organisational measures to protect against unauthorised access, loss, or misuse. Personal data submitted through our recruitment portal is encrypted in transit and at rest. We use recruitment management software to assist with application management, including flagging responses to eligibility questions for human review. No solely automated decisions are made about your application.
Who We Share Your Data With
We share data internally with hiring managers, interviewers, Directors, trustees and the Head of Operations as necessary.
External sharing is limited to professional HR advisors, referees (with your consent) and Disclosure and Barring Service (if required).
Third parties process data under written agreements ensuring UK GDPR compliance. Our recruitment management software is provided by Personio GmbH, who act as a data processor on our behalf under a data processing agreement compliant with UK GDPR Article 28.
International Applicants
This privacy notice applies to all candidates regardless of your location.
If you are located outside the UK:
- You may have additional rights under your local data protection laws (e.g., EU GDPR, state privacy laws)
- Where we transfer your data internationally, we use appropriate safeguards including Standard Contractual Clauses approved by the UK Government or rely on adequacy decisions
- Where a role requires the right to work in the UK, this will be stated in the relevant job advertisement.
International data transfers:
If we share your data with third parties outside the UK (such as recruitment agencies or assessment providers), we ensure:
- Adequate levels of data protection through contractual safeguards
- Compliance with UK data transfer requirements
- Your rights remain protected regardless of where data is processed
Data Retention
Unsuccessful candidates: Data retained for the recruitment period plus six months (reflecting the primary limitation period for employment tribunal claims under the Equality Act 2010 and Employment Rights Act 1996)
Successful candidates: Data transferred to your personnel file and retained in accordance with employment retention policies (currently for six years after ending your employment with us).
Talent pool candidates (where you have consented to be considered for future roles): Data retained for 12 months from the date of your original application, after which your data will be deleted unless you are contacted about a specific role within that period.
Your Rights
Under UK GDPR, you have the right to:
- Access your personal data
- Rectify inaccurate information
- Erase your data (subject to legal limitations)
- Restrict processing in certain circumstances
- Object to processing
- Data portability (where applicable)
To exercise these rights, contact our Data Protection Lead at privacy@digacommunications.com. We will respond within one month as required by UK GDPR Article 12.
Complaints
If you believe we have not complied with data protection law, you may complain to:
Information Commissioner's Office (ICO)
Website: https://ico.org.uk/
Helpline: 0303 123 1113
Consequences of Not Providing Data
Providing personal data is not a statutory requirement, but failure to provide requested information may prevent us from processing your application.
Successful candidates must provide:
Evidence of right to work in the UK, where required for the role
Satisfactory references
These are conditions of any employment offer.
Equal opportunities monitoring is voluntary with no impact on your application.
Contact Us
For questions about this notice or how we handle your data, please contact our Data Protection Lead at privacy@digacommunications.com.
Last updated: March 2026