Applicant Privacy Notice

1. Introduction

Fortnum & Mason Plc (“we”, “us”, “our”, “F&M”) is committed to being transparent about how we collect and use your personal data and to meeting our data protection obligations. We are the data controller in respect of your personal data and our registered office is at: 181 Piccadilly, London, W1A 1ER. If you have any questions or concerns around how your personal data is being collected, used or stored, please contact hr@fortnumandmason.co.uk.

This privacy notice applies to all individuals who submit an application to work at F&M (either directly on our website, through a recruitment agency or a website such as Indeed), engage in our recruitment and interview process and attend selection centres (“Applicants”). We process your personal data for our legitimate interests, in order to fulfill our prospective contract of employment with you and to fulfill our legal obligations.

When you are an Applicant, your personal data will be processed in accordance with data protection laws and for the purposes set out in this notice and we will not process your personal data in any manner incompatible with those purposes unless we are required by law to do so.Please note that, if your application is successful, the data will then be used to administer your personnel record and your personal data will then be processed in accordance with our Colleague Privacy Notice.

This notice may be amended from time to time and was last updated on 19 November 2025.

2. What information do we process about Applicants

We handle the following types of personal data about Applicants:

Identity Data: name, date of birth, right to work status and applicant status;
Contact Data: addresses, telephone numbers, email addresses
Recruitment Data:

Information included in your application form, CV or cover letter such as qualifications, skills and competencies, experience and employment history, academic background and training related information, personal interests, languages spoken, qualifications.
Information that you have provided to us during the interview process and selection centres (including interview notes and selection centre documentation).
Records/results of any pre-employment checks.
Information about you provided by your named third-party referees.

Preferences Data: Job preference, type of employment sought or willingness to relocate.
Financial Data: Current and historic salary details together with salary expectations and details of your current benefit entitlements.
CCTV Data: When you attend an interview or selection centre, your images may be recorded on CCTV and other surveillance systems (including body worn cameras / video).
We may also handle the following special categories of personal data about Applicants (if applicable in the circumstances and it is provided to us):

Information about your race or ethnicity, religious or philosophical beliefs or sexual orientation.
Information about your health, including any medical condition.

We may also collect and use information about criminal convictions and offences where you are to be based at an Airport location, or it is required in relation to your job role.

3. Where do we collect your information from

We collect personal information about Applicants from a number of sources including:

Through the recruitment process (either from you directly or sometimes from a recruitment agency or employment background check provider).
From third parties, for example former employers or other third parties who provide us with a reference about you.
From criminal convictions and offences providers.

Having received the information provided by you, we will process that information to decide whether you meet the requirements to be shortlisted for the role. If you do, we will decide whether your application is strong enough to invite you to an interview. We will use the information provided to use at the interview and to decide whether to offer you the role.

We will then seek information from third parties, including referees (and employment background check providers or criminal convictions and offences check providers where applicable) only once a job offer to you has been made and we have communicated to you that we will be doing so.

4. Lawful basis and purposes for processing your information

The purposes and lawful basis for which we will process your personal information are set in the table below. We will notify you of any changes to information we collect or to the purposes for which we collect and process it in this context.

Please note that, where we rely on consent and you do not give consent, this may impact our ability to process your application.

Purpose / Activity	Category of Personal Data	Lawful Basis
Communicating with you throughout the recruitment process	Identity Data Contact Data	Our legitimate interests (to keep in touch with Applicants)
To process applications and facilitate the selection process Making a decision about your recruitment or appointment To conduct reference checks Determining the terms upon which you work for us	Identity Data Contact Data Recruitment Data Financial Data Preferences Data	Performance of a contract (to decide whether to enter into a contract with you) Our legitimate interests (to conduct recruitment) Consent (only where we are requesting consent to contact your nominated referees)
Assessing your skills, qualifications and confirming your suitability for employment / the role that you have applied for	Identity Data Recruitment Data Preferences Data	Our legitimate interests (to ensure individuals applying for a position have the required skills, qualifications, experience, education and suitability to perform the role)
To carry out background and referencing checks, where applicable	Identity Data	Consent
Checking you are legally entitled to work in the UK	Identity Data	Ensuring compliance with our legal obligations as an employer
Keep records related to our recruitment processes Identifying further education, training and development areas Business process execution, management and planning	Recruitment Data Preferences Data	Our legitimate interests (of department organisation, identifying skill gaps for recruitment and to ensure the correct individuals are in the right role)
To keep our premises safe and secure To progress investigations of any nature including security breaches and health and safety	CCTV Data	Our legitimate interests (to ensure the security and safety of our premises, Colleagues and visitors, to exercise and defend legal claims) Assisting with the prevention and detection of crime.

The purposes and lawful basis for which we may process your special category data and information about criminal convictions and offences, if applicable, are set in the table below.

Purpose / Activity	Type	Lawful Basis
Special Category Data
For monitoring and reporting, such as equal opportunities, diversity, equity and inclusion, employee resource group	- Health - Race or ethnicity - Religious beliefs - Sexual orientation	Necessary for performing or exercising obligations or rights in relation to employment law
Ascertaining whether we need to make reasonable adjustments for your interview or in the workplace	- Health	Necessary for performing or exercising obligations or rights in relation to employment law
Criminal Convictions and Offences
To assess an Applicant's suitability for a vacancy, including their professional integrity and accountability, where required for the particular job role To satisfy the security measures put in place at all Airport locations in the UK or as may be required for particular job roles	Criminal Convictions and Offences	Ensuring compliance with our legal obligations We are authorised under a condition set out in applicable law Consent

5. Automated decision-making

A combination of human intervention and automated decision-making are possible with the process to make decisions around Applicants who are not legally entitled to work within the UK. We do not envisage using automated systems to make any further decisions about your application; however, we will notify you in writing if this changes.

6. Sharing your information within F&M and with third parties

We may share personal data about Applicants within F&M:

Other F&M group companies as part of the recruitment process;
Managers in the business area where there is a vacancy; and
Senior management in the case of senior posts.

We may share personal data about Applicants with the following third parties:

In-house and external recruiters and recruitment agencies; and
Service providers relevant to applications, such as our HR System/database, applicant screening providers and applicant tracking systems.

When we use third parties to process information on our behalf, we require them to commit to compliance with relevant data protection legislation. Please contact us if you want further information about who we transfer your data to and in what capacity they may use it.

7. Will your information be transferred outside the UK/EEA

Applicant personal data will not be transferred outside of the UK/EEA. We will notify you in writing if this changes, and where we do transfer applicant personal data outside of the UK/EEA in the future we will:

We will only transfer your personal data to countries that have been deemed by the UK to provide an adequate level of protection for personal data; or
We may use specific standard contractual terms approved for use in the UK which give the transferred personal data the same protection as it has in the UK, namely the International Data Transfer Agreement or the International Data Transfer Addendum to the European Commission’s standard contractual clauses for international data transfers.

8. How long do we keep hold of your information

Applicant personal data will not be kept for longer than is necessary for the recruitment process unless the data is relevant to a successful Applicant’s employment. In such cases, relevant data will be transferred to our HR information in accordance with our Colleague Privacy Notice.

Unsuccessful Applicants’ personal data held in our structured files will be deleted within six (6) months of the decision unless the applicant consents to our retaining the information for a defined period for the purpose of being considered for other potential job openings.

Should you wish to find out more information about how long we retain personal data, please contact hr@fortnumandmason.co.uk.

9. What are your rights?

You have the following rights:

To obtain access to your personal data - you may request information on how your personal data is handled by us and request a copy of such personal data;
To request us to correct or update your personal data if it is inaccurate or out of date;
To object to the processing of your personal data for the purposes of our legitimate interests, unless we:

demonstrate compelling legitimate grounds which override your right to object; or
the processing is necessary for the establishment, exercise or defence of legal claims;

To erase your personal data held by us:

which are no longer necessary in relation to the purposes for which they were collected;
to the processing of which you object; or
which may have been unlawfully processed by us;

To restrict processing by us, i.e. the processing will be limited to storage only:

where you oppose to deletion of your personal data and prefer restriction of processing instead, or
where you object to the processing by us on the basis of its legitimate interests; and

To transmit personal data you submitted to us back to you or to another organisation in certain circumstances.
To withdraw your consent:

Where we process your personal data on the basis of your consent, you have the right to withdraw your consent at any time.
If you wish to withdraw your consent, please contact hr@fortnumandmason.co.uk.

The right to erasure, to restrict processing and to transmit personal data listed above may not apply in cases where the processing is necessary for compliance with our legal obligation or the establishment, exercise or defence of legal claims.

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

These rights are not absolute and may be subject to certain conditions under the UK GDPR. Should you wish to exercise any of these rights, please contact hr@fortnumandmason.co.uk.

10. Contacts

If you have any questions about this privacy notice or information we hold about you, please contact hr@fortnumandmason.co.uk.

11. Complaints

We strive to process your personal data in accordance with the applicable legal obligations but if you have any complaint(s) in that regard, please address your complaint(s) using the contact hr@fortnumandmason.co.uk

You also have the right to lodge a complaint with the UK data protection regulator, if you are not happy with how we handle your personal data and we could not provide you with a satisfactory resolution to your request. You can find their contact details at www.ico.org.uk.

Privacy Policy