Last Updated: 3rd June 2026 (Version:0306PG26)
We, (Fastnet Group), follow six key principles when dealing with your personal data. We will ensure it is:
We operate these principles alongside our duty of confidentiality to you.
2.1 This policy applies to job applicants and/or those that subscribe to our job alerts.
2.2 Where we have referred to other websites in this policy or elsewhere on our webpage which are run by third parties, visiting those websites may allow third parties to collect or share data about you. We have no control over these external websites or responsibility for the privacy policies they operate, and recommend you review their policies before submitting any personal data to them.
3.1 Personal data is information that can be linked to a living individual.
3.2 A data controller can be an individual or an organisation. They decide what personal data to collect and how it will be used.
3.3 Processing data includes collecting, recording, organising, structuring, storing, adapting, altering, retrieving, consulting, using, disclosing, disseminating, aligning, combining, restricting, erasure or destruction of data.
4.1 This policy is provided on behalf of the following firms :
4.2 The above firms and individuals are referred to collectively as ‘Fastnet’, ‘us’ or ‘we’, or ‘the firm’ in this policy.
5.1 For data protection queries and to exercise your rights, you can contact us in these ways:
Post: Privacy queries, Fastnet Group, Unit 9 Sole End Estate, Bedworth, Warwickshire, CV12 0NE
Telephone: 07717 437027
Email: Our dedicated email address for data protection matters is den@fastnet.group
5.2 Fastnet does not have a Data Protection Officer. Our Director(s) oversee data protection matters.
6.1 The firm needs to process data as part of the recruitment process and to meet its obligations under relevant legislation. The data used in the recruitment process may be subsequently used for employment purposes if your application is successful.
6.2 In some cases, the firm needs to process data to ensure that it is complying with its legal obligations. For example, it is required to check an individual’s entitlement to work in the UK and to comply with health and safety laws.
6.3 In other cases, the firm has a legitimate interest in processing personal data before any employment relationship may develop.
6.4 Processing job applicant data allows the firm to, for example:
6.5 Some special category data, such as medical records and other information about health or medical conditions, is processed to carry out employment law obligations (such as those in relation to employees with disabilities). We rely on these obligations as one of the processing conditions under data protection legislation to process this kind of data. See section 8.1.2.
6.6 Where the firm processes other special category data, such as information about ethnic origin, sexual orientation or religion or belief, this is done for the purposes of equal opportunities monitoring. This is to carry out its obligations and exercise specific rights in relation to employment.
6.7 Certain information, such as your right to work in the UK, have to be provided to enable the firm to know whether it will be able to enter into a contract of employment with you. If you do not provide other information, this will hinder the organisation’s ability to administer the rights and obligations arising as a result of any subsequent employment relationship efficiently.
7.1 We must have a lawful basis to process your personal data.
7.2 These are the bases we most often rely on:
7.2.1 Contractual
7.2.1.1 The processing is necessary because you have asked us to take specific steps before entering into a contract of employment with or via us. This is regardless of whether the contract negotiation is successful, i.e. whether the recruitment process leads to you being employed by or via the firm. It also includes processing personal data where we ask you to take an assessment and the result leads to a solely automated decision about your application.
7.2.1.2 We would be unable to carry out contract negotiations with you if you did not provide or we were unable to process your personal data under this lawful basis.
7.2.2 Legal obligation
7.2.2.1 The processing is necessary for us to comply with the laws or regulations we are subject to (not including our contractual obligations).
7.2.2.2 We would be unable to process your application if you did not provide or we were unable to process your personal data under this lawful basis.
7.2.3 Legitimate interests
7.2.3.1 We also undertake processing in our legitimate interests or the legitimate interests of a third party. We check beforehand that this processing is not going to override your rights and interests.
7.2.3.1 We rely on legitimate interests to allow us for example, to:
7.2.4 Consent
7.2.4.1 We may ask your consent in specific circumstances. We may be unable to process or continue with your application if you did not provide consent, as we could not process the personal data. We may seek consent from you to share your personal data with other parties, which are not identified under the other lawful bases we use.
We ask you to consent to the use of cookies when using our website. More information about cookies can be found in our cookie policy, along with how to withdraw your consent.
8.1 We deal with two kinds of personal data as defined under the legislation.
8.1.1 Personal data
This is information that can be linked to a living individual. The firm collects and processes a range of information about you. This includes, for example:
8.1.2 Special category data (also referred to as sensitive personal data)
We seek this kind of data in limited circumstances. It should not be provided to us unless specifically requested or required.
8.1.2.1 Although often described as information about your physical and mental health, this category of data also covers personal data referring to racial or ethnic origin; political opinions; religious or philosophical beliefs; trade union membership; sexual orientation and health, along with genetic data and biometric data.
8.1.2.2 Information about medical or health conditions, includes whether or not you have a disability for which the firm would need to make/or have made reasonable adjustments.
8.1.2.3 Equal opportunities monitoring information includes information about your ethnic origin, sexual orientation and religion or belief.
8.1.2.4 As well as needing a lawful basis, we must follow an additional rule (processing condition) to process special category data. We most often uses the following processing conditions:
We may draw upon other processing conditions listed in data protection legislation. Criminal conviction data is not classed as special category data under this legislation. However, we rely on a similar set of processing conditions if it is necessary to process this kind of data.
8.1.3 If you are providing us with information about other individuals, you should make them aware that we will be processing their personal data
8.1.4 Photos and video recording
We may take photographs and/or make video recordings of the events, including fundraising activities, that we arrange, facilitate or are involved in, and which you attend or participate. This material may be used by us or business partners, and/or distributed in social media in order to publicise this event.
If you would prefer not to be included in these photos or videos, please inform us prior to the start of the event or otherwise make us aware at the time.
We operate CCTV monitoring at our premises for safety and security purposes.
As part of our recruitment procedures, we may receive video presentations from individuals interested in working with us. We use these video presentations in our initial assessment of an individual’s suitability for a role with us. This material is not shared outside Fastnet Group without the individual’s consent.
9.1 We firm may collect information about you in a variety of ways. For example, data might be collected through application forms, CVs or resumes; obtained from your passport or other identity documents such as your driving licence; or through interviews, meetings or other assessments.
9.2 In some cases, the firm may collect personal data about you from third parties, such as references supplied by former employers, educational institutions, information from employment background check providers, information from credit reference agencies and information from criminal records checks permitted by law.
9.3 We will also obtain personal data from you when you, for example:
When you visit our website, it is set up to collect some information about you automatically, this may include:
Our website uses cookies to distinguish you from other users of our site. This helps us to provide you with a better experience when you browse our site and also allows us to improve our site. Cookies are usually a string of numbers and/or letters that a website transfers to your hard drive. The cookies enable the website to ‘remember’ you, either for the duration of your visit (session cookies) or for repeat visits (persistent cookies).
The most common kinds of cookies we use are :
Most web browsers automatically accept cookies but, if you prefer, you can change your browser settings to prevent this. Cookies can be managed through the browser menu and are commonly referred to as ‘preferences’, ‘privacy’ or ‘security’.
You are not obliged to accept cookies, however, you may not be able to take full advantage of our site or use certain functions if you disable them.
We will also collect location information from you e.g. your IP address when completing or signing documentation online. Such online signing applications (sometimes called e-signature), capture your signature electronically on documents connected with the recruitment activity work we undertake with you and related parties, and record details of the email address used to sign the document, as well as the date, time and location (IP address) of the signature made. You might be asked or choose to complete other fields or provide additional information when using these applications.
We may also use tracking technologies, such as tracking pixels inserted in our emails. The pixel will tell us things like whether you opened the email, how many times and the device you used, this helps us better manage and improve our communications with you. The email pixel sits within the email communication, but it stores nothing on your device. If you delete the email this will also delete the pixel. If you do not wish to share this information with us, you will need to unsubscribe from our mailings. You can update your marketing preferences at any time by contacting us, or you can unsubscribe following the instructions in the individual email communications you receive from us.
9.4 We may obtain or receive information about you from third parties and publicly- available sources, such as
9.5 Data will be stored in a range of different places, including in your personnel file, in the firm’s HR management systems and in other IT systems (including the firm’s email system).
10.1 Depending on the nature of the activity being undertaken, the lawful basis and purpose of processing, we may need to share your personal data between the data controllers listed at the beginning of this policy, suppliers and others involved in the running of the firm or with whom we need to deal. These parties are subject to data protection legislation and principles. We will usually have notified you of the sharing of your data with these parties. However, certain legislation may prevent us from doing so. Many of these parties both receive personal data from us and provide it to us.
10.2 Your information may be shared internally, including with members of the HR and recruitment team, health and safety representatives, the relevant manager or managers in the recruitment activity, directors, partners and IT staff if access to the data is necessary for performance of their roles.
10.3 The firm shares your data with third parties in order to obtain pre-employment references from other employers, obtain employment background checks from third-party providers and obtain necessary criminal records checks from the Disclosure and Barring Service.
10.4 Other parties may include:
10.5 Furthermore, we will disclose your personal information:
10.5.1 in the event that we sell or buy any business or assets, in which case we will disclose your personal data to the prospective seller or buyer of such business or assets, or their advisers.
10.5.2 if we or substantially all of our assets are acquired by a third party, in which case personal data held by us about job applicants will be one of the transferred assets.
Fastnet has a legal obligation to follow prevailing anti-money laundering legislation and takes steps to prevent fraud. It is also in our legitimate interests to do so.
We do not currently undertake credit reference checks as part of the recruitment process.
Where data sharing takes place between us and others, where both or all parties are independent data controllers, our approach is described in this section of our policy. We may apply an exemption to this section, for example we will not seek a warranty from data controllers such as HMRC and other similar organisations.
We warrant, and require all other data controllers associated with any agreed data sharing to warrant, that:
We shall each be considered an independent data controller in relation to personal data, unless otherwise agreed in writing between us. Each of us will comply with all requirements and obligations applicable to us under the data protection legislation in respect of personal data. Sharing of the data does not imply any consent (explicit or otherwise), permission or confirmation has been received from the data subjects, provider or processor of the data that the data can be used in any particular way. Each party will make its own assessment of what it is permissible for them to do with the data under data protection legislation.
Personal data will only be disclosed between parties where each party warrants that:
We shall only process the personal data shared with or between us for the agreed purpose(s).
In respect of personal data shared with or between us, provided that we are legally permitted to do so, we shall notify the relevant other data controller(s) in the event that:
Upon the reasonable request of the other, we shall each co-operate with the other and take such reasonable commercial steps or provide such information as is necessary to enable each of us to comply with the data protection legislation in respect of the services provided to clients, the holding of events, or for any other agreed purpose(s), in accordance with the engagement letter or other documentation with them in relation to those services.
Where we agree that we will be acting as joint data controllers, as defined under GDPR as ‘Where two or more controllers jointly determine the purposes and means of processing, they shall be joint controllers’ we will agree the necessary steps to meet the requirements under data protection legislation if the parties consider they are not covered by the above wording. This may include stating a central point of contact for all relevant data subjects.
Where we have agreed to provide access to an application, platform or other means to share data and documentation, we will be advised immediately when that access is no longer required or needs to be removed. Any login information and passwords linked to such access will be retained securely and not shared with any other party.
13.1 Where we are appointing any individual or organisation to process your personal data on our behalf (otherwise known as ‘data processors’), they may only do so for specified purposes and according to our written instructions. Fastnet Group seeks confirmation of the processor’s IT security arrangements and whether personal data is processed outside the European Union. Some data processors may use anonymised or pseudonymised data for research, statistical or survey purposes, or to enable ongoing development of their services or products.
14.1 Where possible, we or our appointed data processors will process your personal data within the European Union (EU). If your personal data does need to be transferred outside the EU, we ensure appropriate safeguards are in place to ensure that your data is properly looked after.
14.2 We ensure personal data is adequately protected and take into account:
14.2.1 Where the UK Government has decided that a country, a territory or one or more specific sectors in a country, or an international organisation, ensures an adequate level of protection.
14.2.2 Other safeguards available to us under data protection legislation to transfer data internationally, such as Standard Contractual Clauses.
15.1 We operate a series of security measures concerning access to our offices and our systems. The level and extent of each individual measure may vary, but can include, for example:
15.2 Access controls to buildings, systems and, where appropriate, individual IT applications; anti-virus and malware prevention; breach logging; encryption; equipment/access logs; horizon scanning; arranging back-up copies of personal data; penetration testing, system monitoring and system updates (e.g. patching).
15.3 For applications running on our in-house systems, we operate a back-up facility as contingency. Our back-up data is held off-site within the UK.
15.4 We have a Business Continuity Plan (BCP) in place which is tested periodically. The BCP covers for example: Business continuity and disaster, recovery management strategy and policy; key contacts and crisis management team members; triggers for invoking and revoking plans; roles and responsibilities; communication plans– internal and external, including with service providers and IT suppliers; specific threat plans.
15.5 Where we have given you (or where you have chosen) a password which enables you to access certain parts of our systems, you are responsible for keeping this password confidential. We ask you not to share that password with anyone.
15.6 The transmission of information via the Internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to us or vice-versa; any transmission is at your own risk.
15.7 Where we have given you (or where you have chosen) a password which enables you to access certain parts of our site or any other website we direct you to as part of our recruitment activity, you are responsible for keeping this password confidential. We ask you not to share that password with anyone.
16.1 In line with data protection principles, we only keep your data for as long as we need it for.
16.2 If your application is unsuccessful and we have sought your consent to keep your data on file for future job opportunities and you have provided consent, we will keep your data for twelve months once the recruitment process ends. At the end of this period, we will delete or destroy your data, unless you have already withdrawn your consent to our processing of your data in which case it will be deleted or destroyed upon withdrawal of consent.
16.3 If your application is successful, your data will be kept and transferred to the systems we administer for employees. We have a separate privacy policy for employees, which will provided to you if appropriate.
16.4 The timescales for the retention of your personal data and related documentation are subject to various legal, regulatory or contractual requirements, which will reflect the purpose and lawful basis for processing the data.
17.1 Data protection legislation provides the following legal rights for individuals:
You have the right to:
We may use your personal data as part of our recruitment processes. For example, you may need to answer initial questions or complete an online test before being invited to attend a telephone or face-to-face interview. If you do not meet the minimum requirements for the position you are applying for, complete the test or do not reach the required pass mark, this will mean that we are unable to proceed with shortlisting you for an interview or continue processing your application.
The personal data you submit as part of any psychometric or other assessment may subsequently be used by the provider for research purposes, but the data will be anonymised or aggregated so that no individual can be identified.
You can exercise your rights at any time by contacting us using any of the contact details in section 5 of this policy.
Some rights can only be exercised under certain circumstances. If we are unable to comply with your request for any reason, we will contact you to explain our reasoning.
More information is available from the Information Commissioner’s Office website: For the public | ICO
17.2 You can exercise your rights at any time by contacting us using any of the contact details at the beginning of this policy. More information is available from the Information Commissioner’s Office website For the public | ICO
17.3 Some rights can only be exercised under certain circumstances. If we are unable to comply with your request for any reason, we will contact you to explain our reasoning.
18.1 Fastnet Group aims to deal efficiently with any query or to resolve any complaint you might have about how we handle your personal data. You can raise a complaint via using the contact details in Section 5. You can submit your complaint in writing by letter or email, or by phone.
18.2 Your right to complain
18.2.1 If you consider we have processed your data in a way that infringes the legislation or are unhappy about the way we have handled your complaint, you have the right to complain to the Information Commissioner’s Office. Their contact details are:
Telephone/live chat: 0303 123 1113 (local rate) or use the ICO’s live chat service on their website.
19.1 The content of this privacy policy may change periodically.
19.2 Each version of the policy will be uniquely referenced & displayed at the top of this page
