Privacy notice for job applicants

Big Ben with a red London bus driving past.

We are committed to protecting your privacy and complying with data protection legislation. This Privacy Notice contains important information about us, how and why we collect, store, use and share personal data, your rights in relation to your personal information and on how to contact us if you have a complaint and the Information Commissioner’s Office (ICO) if you remain dissatisfied.

If you are reading this Privacy Notice on our website, www.dmhstallard.com, please also refer to the separate website privacy notice and our Cookie policy which explains the use of cookies on our website.

Introduction

This privacy notice details how we collect and use personal information about you during the recruitment process, in accordance with the UK General Data Protection Regulation (“GDPR”) and the Data Protection Act 2018. It applies to current and former job applicants and candidates.

This notice does not form part of any contract of employment or other contract to provide services and we may update this notice at any time.

About us

This privacy notice is issued on behalf of DMH Stallard LLP (registered number OC338287) and DMH Stallard Service Company Limited (registered number 01832830) so when we mention “we”, “us” or “our” in this privacy notice, we are referring to the relevant entity responsible for processing your personal data. We may transfer your data between the entities where we are legally obliged to do so or where it is in our legitimate interests to do so.

DMH Stallard LLP and DMH Stallard Service Company Limited may act as single or joint data controller(s) of the data we process about you. Since we are a “controller” in relation to personal data, this means that we are responsible for deciding how we hold and use personal information about you. You are being sent a copy of this privacy notice because you are applying for work with us (whether as an employee, worker, contractor, temporary or agency worker or work experience student). It makes you aware of how and why your personal data will be used, namely for the purposes of the recruitment exercise, and how long it will usually be retained for. It provides you with certain information that must be provided under the GDPR.

Data protection principles

We will comply with data protection law and principles, which means that your data will be:

Used lawfully, fairly and in a transparent way.
Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.
Relevant to the purposes we have told you about and limited only to those purposes.
Accurate and kept up to date.
Kept only as long as necessary for the purposes we have told you about.
Kept securely.

Who is your personal information collected from?

We collect personal information about you from the following sources:

You, the candidate.
Recruitment agencies, from which we may collect the following categories of data: personal contact details (such as your name, address, phone number, personal email address), curriculum vitae (“CV”), qualification certificates and other categories of data to assess your suitability for the role.
Solicitors Regulation Authority to check the Solicitors Register
Disclosure and Barring Service in respect of criminal convictions.
Your named referees, from whom we collect the following categories of data: employment history, qualifications and other categories of data to assess your application.
The following data from third parties is from a publicly accessible source: personal contact details (such as your name and address).

The kind of information we hold about you

In connection with your application for work with us, we will collect, store, and use the following categories of personal information about you:

The information you have provided to us in your CV and covering letter.
The information you have provided on our application form, including name, address, telephone number, personal email address, education history, qualifications, evidence of your right to work in the UK, confirmation of any criminal convictions and employment history.
Any information you provide to us during the interview process.
The results of any tests we ask you to complete.
Information obtained from sources other than yourself previously referred to in this notice.

This may involve us collecting, storing and using the following types of more sensitive personal information:

Information about your race or ethnicity, religious or philosophical beliefs, trade union membership, sexual orientation and political opinions.
Information about your health, including any medical condition, health and sickness records.
Information about criminal convictions and offences.

How we will use information about you

We will use the personal information we collect about you to:

Assess your skills, qualifications, and suitability for the role.
Carry out background and reference checks, where applicable, including verifying your employment history and qualifications.
Communicate with you about the recruitment process.
Keep records related to our hiring processes.
Comply with legal or regulatory requirements.
Manage our relationship with you.

It is in our legitimate interests to process your personal data to decide whether to appoint you to a role.

We also need to process your personal information to decide whether to enter into a contract with you and to verify your right to work in the UK.

After receiving your CV, covering letter, application form and, where applicable, the results from any tests which you took as part of the recruitment process, we will then process that information to decide whether you meet the basic requirements to be shortlisted for the role. If you do, we will decide whether your application is strong enough to invite you for an interview.

If we decide to call you for an interview, we will use the information you provide to us at the interview to decide whether to offer you the role. If we decide to offer you the role, we will then take up references and, where required, carry out a criminal record check and any other necessary background checks before confirming your appointment.

Before we use your personal data for any new purpose, we will ensure the processing is fair and lawful. In particular, we will confirm that an appropriate lawful basis applies to the new purpose and (where relevant) that any additional requirements for special category data or criminal offence data are met. We will carefully consider whether any new use is compatible with the original purpose for which your data was collected.

We will not use your personal data in ways that are unexpected, unfair, or that could have an unjustified negative impact on you.

In certain circumstances, the law treats further processing as compatible without requiring a full compatibility assessment, for example, where processing is carried out for archiving in the public interest, scientific or historical research, or statistical purposes, provided appropriate safeguards are in place.

Where we do intend to use your data for a new purpose, we will inform you and provide any relevant information before doing so. In some cases, you will have the right to object to that use, and we will make you aware of this right whenever it applies.

Use of artificial intelligence (“AI”) in our recruitment process

We may use AI and AI-assisted tools during certain stages of our recruitment and interview processes. We currently use Harvey AI.

This section of the notice explains how we use these tools and what this means for you as a job applicant.

How we may use AI

We may use Harvey AI, an artificial intelligence platform provided by a US company registered in Delaware, to support parts of our recruitment process. This may include, for example, using Havey AI to screen application forms or CVs to identify candidates whose skills and experience match the requirements of a role, supporting the assessment or shortlisting of candidates, analysing responses provided during the application process and generating interview questions. To do this, our staff may input your personal data into the platform, and Harvey AI would generate outputs using large language models.

We may process the following personal data when using Harvey AI for recruitment:

Candidate name (full name);
Contact details (email address, telephone number, postal address);
Employment history and professional experience;
Education, qualifications and professional certifications;
Skills, competencies, and any other information provided by the candidate in their application materials; and
Role specification and job description data (this is not personal data, but the LLP processes it alongside Candidate Data).

Where we use AI in this way, it is used as a tool to support our recruitment team rather than to replace human judgement.

Legal Basis for Processing

When we use AI in the recruitment process, we process your personal data in accordance with the GDPR and the Data Protection Act 2018. Our legal basis for this processing is that we have a legitimate interest in operating an efficient, fair and consistent recruitment process to identify the most suitable candidates for each role while reducing the time and cost of high-volume recruitment exercises.

We do not intend to process any special category/criminal data using AI tools. However, if we process any special category data (such as information about a disability) using AI tools, we will only do so where we have an additional lawful basis for doing so, such as to comply with our employment law obligations.

Automated Decision-Making and Profiling

Automated decision-making is the process of making decisions by automated means, with or without any human involvement.

We may use AI to shortlist candidates based solely on automated processing which produce legal effects concerning you or similarly significantly affects you. We will provide you with information about the decision, including the logic involved, the main factors/criteria used in the decision-making, and the significance and envisaged consequences for you.

If you believe that a decision has been made about your application on a solely automated basis, you have the right to request human intervention, to express your point of view, and to contest the decision.

If you wish to exercise any of these rights, or if you have any questions about how we use AI in our recruitment process, please contact our DPO whose details are below.

If you fail to provide personal information

If you fail to provide information when requested, which is necessary for us to consider your application (such as evidence of qualifications or work history), we will not be able to process your application successfully. For example, if we require a credit check or references for this role and you fail to provide us with relevant details, we will not be able to take your application further.

How we use particularly sensitive personal information

Where appropriate we will use your particularly sensitive personal information in the following ways:

We use information about disability to consider whether we need to provide appropriate adjustments during the recruitment process, for example whether adjustments need to be made during a test or interview.
We use information about racial or ethnic origin, religious or philosophical beliefs, disability or sexual orientation to ensure meaningful equal opportunity monitoring and reporting.

Information about criminal convictions

We envisage that we will process information about criminal convictions.

We will collect information about your criminal convictions history if we would like to offer you the role (conditional on checks and any other conditions, such as references, being satisfactory). We are entitled to carry out a criminal records check in order to satisfy ourselves that there is nothing in your criminal convictions history which makes you unsuitable for the role. In particular:

We may be required by the SRA to carry out criminal record checks for those carrying out specific roles.
We may be required to carry out standard or enhanced checks from the Disclosure Barring Service, if your role is one which is included in the Rehabilitation of Offenders Act 1974 (Exceptions) Order 1975 (SI 1975/1023), and/or if your role is also included in the Police Act 1997 (Criminal Records) Regulations (SI 2002/233).
We may seek a basic disclosure of your criminal records history if your role requires a high degree of trust and integrity, for instance if it involves dealing with high value client money.

We have in place an appropriate policy document and safeguards which we are required by law to maintain when processing such data.

Cookies and similar technologies

Our website uses cookies and similar technologies (cookies). Some cookies are essential for functionality and security. We also use cookies (including those set by trusted third parties) to help us understand how candidates use our recruitment pages, improve the website, and measure the effectiveness of our recruitment activity. For analytics and optimisation cookies, we provide clear information and an easy way to opt out through our cookie settings. Some cookies, particularly those set by third parties for advertising or tracking purposes, require your consent before we place them on your device. For more information about what cookies are, how we use them, including which third parties may set cookies and their purposes, please see https://www.dmhstallard.com/cookies/. You can change your cookie preferences at any time through our cookie settings.

Data sharing

Why might you share my personal information

We will only share your personal information with another entity in the group and, in some cases, third party service providers (such as Law Business Research (the providers of our applicant tracking system, AllHires), and Harvey AI) for the purposes of processing your application. All our third-party service providers and other entities in the group are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.

We may need to share your personal information with a regulator or to otherwise comply with the law, such as where there is litigation and we are required to disclose personal information to a court or tribunal.

We may transfer your personal information outside the EU. If we do, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data. For further details, contact our DPO.
Where we use certain service providers located outside the UK, we use specific contracts approved by the UK which give personal data the same protection it has in the UK. For further details, contact our DPO.

Data security

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need-to-know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality. Details of these measures may be obtained from our DPO via the contact details outlined below.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

Data retention

How long will you use my information for?

We will retain your personal information for as long as necessary to fulfil the purposes we collected it for, after we have communicated to you our decision about whether to appoint you to the role. We retain your personal information for that period so that we can show, in the event of a legal claim, that we have not discriminated against candidates on prohibited grounds and that we have conducted the recruitment exercise in a fair and transparent way. After this period, we will securely destroy your personal information in accordance with applicable laws and regulations.

In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you.

If we would like to retain your personal information on file, on the basis that we might be able to consider you for an opportunity that may arise in future, we will write to you separately, seeking your explicit consent to retain your personal information for that purpose.

Where you are successful in the recruitment process, we will collect personal information in the course of job-related activities throughout the period of you working for us and we will issue you with an updated privacy notice in respect of this processing.

Rights of access, rectification, erasure, objection, restriction and data portability

Your rights in connection with personal information

Under certain circumstances, by law you have the right to:

Request access to your personal information (commonly known as making a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it;
Request rectification of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected;
Make a complaint to us about how we use your personal data (see “Complaints” below for information about how to make a complaint);
Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below);
Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes;
Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it;
Request the transfer of your personal information to another party; and
Right to withdraw consent. In the limited circumstances in which you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact the DPO via the details outlined below. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

If you would like to exercise any of those rights, please contact our Data Protection Officer using the details below:

Address:
DMH Stallard LLP
The Portland Building
27-28 Church Street
Brighton
East Sussex
BN1 1RB

Email: [email protected]

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

If you wish to make a complaint about how we have handled your personal information, please follow the procedure set out in the “Complaints” section below, and any such complaint will be handled in accordance with that section.

Questions

If you have any questions about this privacy notice or how we handle your personal information, please contact the firm’s DPO who has been appointed to oversee compliance with this privacy notice and whose contact details are [email protected].

Complaints

You have the right to complain if you think we have not handled your personal data properly under UK data protection law. This includes complaints about how we have collected, used, stored or handled your personal data, or how we have responded to a request you have made to exercise your data protection rights.

You may make a complaint by completing and submitting an electronic complaint form, which is available on our website at dmhstallard.com/data-complaints-procedure. You may also submit a complaint by email to [email protected] or by post to the address set out in the preceding section. We will accept complaints made through any of these channels.

Our Data Protection Complaints Procedure explains how we will handle your complaint.

If you are not satisfied with our response, or if you consider that we have not addressed your complaint adequately, you have the right to lodge a complaint with the ICO. The ICO can be contacted at www.ico.org.uk or by telephone on 0303 123 1113.

Changes to this privacy notice

We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.

This Privacy Notice was last updated in July 2026.