Candidate Privacy Notice

Isara Systems Ltd

1. About this notice

This notice explains how Isara Systems Ltd (“Isara”, “we”, “us”) handles personal data about people who apply to work with us, or who are considered for a role with us. It covers applicants for employment, contract, internship and consultancy positions.

Isara Systems Ltd is the controller of this personal data.

Controller	Isara Systems Ltd
Registered address	5–23 Old Street, London EC1V 9HL, United Kingdom
ICO registration number	ZC219161
Data Protection Officer	dpo@isara.ai — Attn: Data Protection Office, 5–23 Old Street, London EC1V 9HL
General contact	support@isara.ai

This notice sits alongside our main Privacy Policy. Where the two differ on recruitment, this notice applies.

We process candidate personal data under the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025. Where you are located in the EU or EEA, we also process your personal data under Regulation (EU) 2016/679 (EU GDPR), and the rights and complaint routes in sections 9 and 10 apply accordingly.

2. Where your information comes from

We collect candidate personal data directly from you — from your CV, application form, covering letter, correspondence with us, and from interviews and conversations during the process.

We may also receive information about you from:

• Referees, where you have named them and we have told you we are approaching them (see section 6).
• Public professional sources, such as a professional profile or portfolio you have made publicly available and referred us to.

If we ever receive your details from a recruitment agency, a referral, or another third party, we will tell you at the point we first contact you, and identify the source.

3. What personal data we process

Category	Examples
Identity and contact data	Name, email address, telephone number, postal address
Application data	CV, covering letter, application form responses, portfolio or work samples
Career history	Employment history, roles, dates, responsibilities, reasons for leaving
Qualifications	Education, professional certifications, training, memberships
Assessment data	Interview notes, our scoring and assessment of your application, feedback
Reference data	Information provided by referees, where references are taken
Correspondence	Emails and messages exchanged with you during the process
Offer data	Salary expectations, notice period, availability, offer terms
Right-to-work data	Nationality, immigration status, and copies of documents evidencing your right to work. We ask for this only after you have accepted an offer, not as part of your application.

Special category data. We do not ask for special category data (Article 9 UK/EU GDPR) as part of an application, and we do not want to receive it. Where you tell us about a health condition so that we can make an adjustment to the recruitment process, we rely on the condition set out in section 4. Where special category data reaches us for any other reason — for example because your CV mentions it — we will not use it to assess you: we will redact it from the record where we practicably can, and otherwise hold it only for the retention period in section 8. If we ever needed to process it for another purpose, we would contact you first.

Background checks. Where a role requires it, we may carry out background checks proportionate to that role — for example verifying your qualifications, or a criminal records check where the role is one for which such a check is permitted by law. We do not carry out background checks as part of initial shortlisting. Before any check is carried out we will tell you what it covers, why it is needed, the lawful basis we rely on, and — where criminal offence data is involved — the condition in Schedule 1 to the Data Protection Act 2018 on which we rely.

Please do not send us more than we need. We ask you not to include in your application information we have not requested — in particular health information, information about your religion, political opinions, trade union membership or sexual orientation, or your date of birth or photograph.

4. Why we process your data, and our legal basis

Purpose	Legal basis
Assessing your application, shortlisting, interviewing you and deciding whether to make an offer	Legitimate interests — Art. 6(1)(f) UK/EU GDPR. Our interest is in recruiting people suitable for the role. We consider this proportionate because we process only what is relevant to the role, and you can object (see section 9).
Communicating with you about your application, scheduling interviews, giving feedback	Legitimate interests — Art. 6(1)(f). Our interest is in running a fair and responsive recruitment process.
Taking up references and verifying the information you have given us	Legitimate interests — Art. 6(1)(f). Our interest is in confirming that the information on which we base a hiring decision is accurate.
Agreeing the terms of your engagement and onboarding you, once you have accepted an offer	Performance of a contract — Art. 6(1)(b). We rely on this basis only once you have accepted a conditional or unconditional offer. Up to that point, including in making the offer itself, we rely on legitimate interests as set out above.
Verifying your right to work in the United Kingdom, after you have accepted an offer	Legal obligation — Art. 6(1)(c). Sections 15 and 21, Immigration, Asylum and Nationality Act 2006, and the prescribed document checks that establish a statutory excuse under section 15(3), as set out in the Home Office code of practice on preventing illegal working. Where we recruit outside the UK, the equivalent local obligation applies.
Making reasonable adjustments to the recruitment process where you tell us you need one	Legal obligation — Art. 6(1)(c), read with section 39(5) and Schedule 8, Part 2, paragraph 5 of the Equality Act 2010, which apply the reasonable adjustments duty to applicants for employment. Where this involves health information, our Article 9 condition is Art. 9(2)(b) UK/EU GDPR (obligations in the field of employment law), read with Schedule 1, Part 1, paragraph 1 of the Data Protection Act 2018. We maintain the appropriate policy document required by paragraph 1(1)(b) and Schedule 1, Part 4 of that Act.
Carrying out a background check where the role requires one	Legitimate interests — Art. 6(1)(f), or legal obligation — Art. 6(1)(c) where the check is required by law. Where criminal offence data is processed, we rely on the applicable condition in Schedule 1 to the Data Protection Act 2018 and will tell you which one before the check is carried out.
Keeping your details on file so we can contact you about future openings	Consent — Art. 6(1)(a). We only do this if you agree, and you can withdraw at any time (see section 9).
Defending or bringing legal claims, including responding to a claim arising from a recruitment decision	Legitimate interests — Art. 6(1)(f). Where special category data is involved, our Article 9 condition is Art. 9(2)(f) (establishment, exercise or defence of legal claims).
Complying with our legal and regulatory obligations, and responding to lawful requests from authorities	Legal obligation — Art. 6(1)(c).

Providing your data. Giving us your personal data is voluntary. However, we cannot assess an application without the information described in section 3 as identity, application, career history and qualification data — so if you do not provide it, we will not be able to consider you for the role. If we offer you a role and you cannot provide right-to-work evidence, we cannot lawfully employ you.

5. No automated decision-making or AI screening

We do not take significant decisions about you based solely on automated processing, within the meaning of Articles 22A–22D UK GDPR — and Article 22 EU GDPR where that applies to you. We do not use AI or algorithmic tools to screen, rank, score or reject applications. There is meaningful human involvement in every decision at every stage of our process.

If this changes, we will update this notice and tell affected candidates before the change takes effect.

6. Who we share your data with

We share candidate personal data with:

• Our own personnel — hiring managers, the team the role sits in, and those responsible for the recruitment decision, on a need-to-know basis.
• Referees you have named, and only after we have told you we are contacting them.
• Professional advisers — for example employment lawyers, where we need advice on a recruitment matter or a claim.
• Competent public authorities, where we are legally required to disclose.
• Service providers who process candidate data on our instructions as processors, under a written contract meeting Article 28 UK/EU GDPR. Today this is limited to our business email and document storage providers. We may in future adopt an applicant tracking system, an interview scheduling tool, a video-conferencing tool, or an assessment platform; where we do, we will update this notice to identify the categories of provider involved before candidate data is processed in them.

7. International transfers

Isara is established in the United Kingdom. Some of our service providers may process personal data outside the UK and the EEA.

Where we transfer candidate personal data outside the UK, we rely on one of the following:

• transfer approval regulations made under Article 45A UK GDPR, where the destination is covered by regulations made following the data protection test in Article 45B;
• the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the European Commission’s Standard Contractual Clauses, as appropriate safeguards under Article 46 UK GDPR;
• the UK Extension to the EU–US Data Privacy Framework, for transfers to certified US recipients.

Transfer approvals made under the former section 17A of the Data Protection Act 2018 continue to have effect under the transitional and saving provisions in Schedule 9 to the Data (Use and Access) Act 2025.

Where we transfer personal data outside the EEA in respect of EU/EEA candidates, we rely on a European Commission adequacy decision (Art. 45 EU GDPR), the Standard Contractual Clauses (Art. 46(2)(c)), or the EU–US Data Privacy Framework, as applicable.

8. How long we keep your data

Data	Retention period
Unsuccessful applicant records (CV, application, assessment notes, correspondence)	12 months from the date we tell you the outcome
Records kept in a talent pool with your consent	For the period we tell you when we ask for your consent, or until you withdraw your consent — whichever is earlier
Right-to-work evidence where an accepted offer is later withdrawn or the engagement does not begin	Deleted as soon as the position is final, and in any event within 12 months
Records of successful applicants	Transferred to your employment or engagement record and retained under our employee privacy notice, which we will give you on joining
Records relevant to an actual or threatened legal claim	Until the claim, and any appeal or limitation period, is concluded

The 12-month period allows us to respond to feedback requests, to defend a recruitment-related claim within the primary employment tribunal window, and to consider you if a similar role opens shortly afterwards. At the end of the applicable period we delete or irreversibly anonymise the records.

9. Your rights

Under the UK GDPR and, where applicable to you, the EU GDPR, you have the right to:

• Be informed about how we use your personal data — that is the purpose of this notice.
• Access your personal data and receive a copy of it (Art. 15).
• Rectification of inaccurate personal data, and completion of incomplete data (Art. 16).
• Erasure of your personal data in certain circumstances (Art. 17).
• Restrict our processing in certain circumstances (Art. 18).
• Data portability — receive data you provided to us in a structured, commonly used, machine-readable format, where the processing is based on consent or contract and carried out by automated means (Art. 20).
• Object to processing based on our legitimate interests (Art. 21). If you object, we will stop unless we can show compelling legitimate grounds that override your interests, or we need the data for legal claims.
• Withdraw consent at any time, where we rely on consent — for example for the talent pool. Withdrawing consent does not affect the lawfulness of processing before withdrawal (Art. 7(3)).

To exercise any of these rights, email dpo@isara.ai. We may need to confirm your identity, or ask you for information to clarify what your request covers, before we act; where we do, the time we have to respond does not start, or is paused, until we receive it (Articles 12(6) and 12A UK GDPR). We will then respond within one month. Where a request is complex, or you make a number of requests, we may extend this by up to two further months, and we will tell you within the first month if we do (Article 12A UK GDPR; Article 12(3) EU GDPR).

Exercising these rights is free of charge, and doing so will not disadvantage your application.

10. Complaints

Complaining to us. You have a statutory right to complain to us if you consider that we have infringed the UK GDPR in relation to your personal data (section 164A, Data Protection Act 2018). You can complain by emailing dpo@isara.ai, or by writing to the Data Protection Office at the address in section 1. We will acknowledge your complaint within 30 days of receiving it, look into it without undue delay, keep you informed of progress, and tell you the outcome.

Complaining to the regulator. You also have the right to complain to the Information Commissioner under section 165 of the Data Protection Act 2018, at any time. You do not have to complain to us first.

• United Kingdom — Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Helpline 0303 123 1113. www.ico.org.uk/make-a-complaint
• EU / EEA — under Article 77 EU GDPR, the supervisory authority in the country of your habitual residence, your place of work, or the place of the alleged infringement. A list is published at www.edpb.europa.eu

11. Changes to this notice

We review this notice at least annually and whenever we change how we handle candidate personal data. The current version is always available at the URL where you found it, and the version and date are shown at the top. Where a change materially affects candidates in an active process, we will tell them directly.