Privacy Notice for Candidates

Privacy Notice for Candidates

This privacy notice describes how we at C&C Group will collect and use your personal data during our recruitment process.

It applies to internal and external candidates who apply to work for any company within our Group, whether directly or through a recruitment agency.

This notice does not form part of any contract of employment or other contract to provide services.

This privacy notice was last updated in February 2026 and we may update it at any time. The latest version will be made available on our recruitment site.

If you have any questions about this privacy notice, or how we collect or use your information, please contact our Group Data Protection Officer at:

C&C Group plc
Wellpark Brewery
161 Duke Street
Glasgow
G31 1JD

Email - gdpr@candcgroup.com

It is important that you read this notice, together with any other privacy information we may provide on specific occasions, so that you are aware of how and why we are using your information.

Your duty to inform us of changes

It is important that the personal information we hold about you is accurate and up to date. Please keep us informed if your personal information changes during the recruitment process.

If you fail to provide personal information

If you fail to provide certain information when requested we may not be able to consider you for a role or fully conduct the recruitment process, or we may be prevented from complying with our legal obligations (such as to ensure the health and safety of our workers).

Information we collect and hold about you

We will use your personal data to assess your suitability for the role you have applied for, and to verify the information you provide in your application. We are also under a legal obligation to conduct checks around your right to work.

Where relevant to the role, and if we make a conditional offer of employment, we will carry out additional pre-employment checks (including Directorship, financial integrity, professional memberships, and employment history). You will be informed if the role is subject to this level of screening as part of the recruitment process.

We have partnered with Rightcheck to help us conduct our right to work and pre-employment checks. Rightcheck are defined as a data processor of your data. You can find more information about them and their ‘My Rightcheck App’ here.

If you would rather not use the Rightcheck process, please let our Talent Team know and we can arrange for checks to be completed manually.

We will collect, store, and use the following categories of personal information during the application and recruitment process:

• Information about who you are e.g. your name, date of birth, address, contact details, National Insurance number, passport, and visa and ‘Right to Work’ details.
• Information about your previous employment e.g. job titles, work history, working hours, training records, references, and professional memberships.
• Compensation history including salary, annual leave, pension, and benefits information.
• Information connected to your education including educational establishments attended, grades and qualifications achieved.
• Other information gathered during the recruitment process e.g. other information included in a CV or cover letter or as part of the application process, contact with us during meetings, phone calls, emails/ letters, and interview comments and notes.
• Information classed as ‘special category’ (sensitive) data relating to your health, race, ethnicity, religious beliefs, or sexual orientation.

We collect personal information either directly from you or from the employment agency representing you. We may collect additional information from third parties including former employers, employment agencies or references that you provide.

How we use special category personal data

Special Category personal data is more sensitive personal data that can reveal racial or ethnic origin, religious or philosophical beliefs, health data, genetic or biometric data, trade union membership, sex life or sexual orientation. 

During the recruitment process you might provide or disclose Special Category data, for example within your CV or during calls or interviews. We may also need to process this type of information to ensure we can meet our legal obligation to make any reasonable and necessary adjustments to enable you to participate in the recruitment process e.g. attend an interview or take a written assessment.

Where you elect to provide it, we will use anonymised information about your race, nationality, or ethnic origin, religious, philosophical or religious beliefs, or your sexual orientation, to ensure meaningful equal opportunity monitoring and reporting. The provision of this information is voluntary and your decision to provide or withhold it will not impact the outcome of your application; it will only be used for the purposes of diversity monitoring and will not be stored with your application.

Please be aware that this information is collected for equality monitoring purposes only and responses are not individually reviewed. Therefore, if you feel you may need or benefit from adjustments to our recruitment and selection processes, please contact careers@candcgroup.com so we may discuss these with you.

Why we use your information

We will only use your personal information when the law allows us to. Most commonly, we will use your personal information in the following circumstances:

1. Where it is necessary to enter into a contract of employment with you, including to enable us to establish whether to enter into such a contract.

2. Where it is necessary to comply with a legal obligation, for example, confirming your right to work in the country where the role is based.

3. Where it is necessary for our legitimate interests (or those of a third party), such as selecting suitable employees.

4. Where you have given us your consent (or explicit consent for Special Category data) to use your information, for example, where you have not been successful in a particular role but we request to keep your information on our records so we can contact you about other opportunities that might arise, or where you have voluntarily provided us with your equality monitoring data.

5. Where it is necessary for the establishment, exercise or defence of legal claims.

6. Where it is necessary for the purposes of preventative or occupational medicine and assessing your working capacity as a potential employee.

7. Where Special Category data is necessary for reasons of substantial public interest, as defined in data protection law, such as for equal opportunities monitoring.

8. As permitted by applicable law.

Data sharing

We may have to share your data with third parties, including third-party service providers and other entities in our Group. We will only do this when it is fair and lawful to do so.

We will share your information with:

- Rightcheck as our provider of right to work and pre-employment screening checks.

- other parts of C&C Group plc. in the context of a business reorganisation or group restructuring exercise, for system maintenance support and hosting of data.

- law enforcement and other appointed agencies who support us (or where they request the information) in the prevention and detection of crime.

- We may share your personal information with other third parties, for example in the context of the possible sale or restructuring of the business.

- We may also need to share your personal information with a regulator or to otherwise comply with the law.

Before disclosing your personal information to such third parties we will take appropriate steps to ensure that those persons are authorised to receive your information, will treat your personal information as confidential and that they will not use such information for any purposes other than within the scope specified by and / or agreed with the Group.

We use the Harbour recruitment management system operated by 3D MarComms Limited (“Harbour”) to capture, store, view, change and otherwise process personal information as part of our recruitment process. Harbour are defined as a data processor for C&C Group, and will only process personal data as instructed by us.

How long we’ll keep your information

If you are unsuccessful in applying for a role, we will keep your data for six months before securely destroying it.

If you ask us to retain your personal information on file, on the basis that a further opportunity may arise in future and you wish to be considered for that (our ‘Talent Bank’), we will keep your data on file for six months before securely destroying it.

If you are successful we will process your personal information in line with our obligations in relation to your contract of employment and will securely destroy your personal information after six years of leaving our employment. 

Your rights in connection with personal information

Under data protection law you have a number of rights, which you can exercise by contacting GDPR@candcgroup.com:

• Request access to your personal information (commonly known as a data subject access request). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
• Request the correction of incomplete or inaccurate personal information that we hold about you.
• Request erasure of your personal information in certain circumstances. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
• Object to processing of your personal information in certain circumstances. You also have the right to object where we are processing your personal information for direct marketing purposes.
• Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
• Request the transfer of your personal information to another party, known as data portability.
• Withdraw your consent. In circumstances where your consent is the lawful basis for the processing, you have the right to withdraw your consent at any time.
• Complain to us about how we’ve handled your personal data or your data rights. You can fill out our complaints form here. This form should not be used for general service complaints relating to C&C Group or its trading entities, nor for general enquiries.

Your right to complain to a data protection regulator

We aim to collect, use and safeguard your personal information in line with data protection laws and guidance. While we hope that we can resolve your concerns through the complaints process outlined above, you can also raise a concern to a data protection regulator:

• For UK residents:

Please note that in due course and as part of the UK Data (Use and Access) Act 2025, individuals will be required to raise their complaint with Matthew Clark Bibendum as the data controller before escalating it to the Information Commissioner’s Office (ICO).

You can find further information and contact details at https://ico.org.uk.

• For Republic of Ireland residents:

You have the right to lodge a complaint with the Data Protection Commission (DPC). You can find further information and contact details at https://www.dataprotection.ie.