PRIVACY NOTICE
Applicant Privacy Notice
How we use your personal data when you apply to work with us.
Last updated
Reference IOS-POL-PRIV-002, version 1.0. Related notices: our Website Privacy Notice, and the Staff Privacy Notice for people who join us.
At a glance
- iO-Sphere Limited is the controller of the personal data you give us when you apply for a job, contract or project with us, or join our coach register.
- We use your data to assess your application, run a fair and safe recruitment process, carry out pre-employment checks and, if you agree, keep you in mind for future work.
- As a regulated education provider, we carry out safer recruitment checks. These can include references, right to work, identity and criminal record checks, depending on the role.
- People, not software, make every decision about your application (see section 7).
- Software helps us read CVs. It lists your qualifications and experience and gives a simple score. A person checks it, it decides nothing, you can see it and challenge it, and you can opt out.
- You choose how long we keep your details after your application closes: until it closes, 6 months, or 12 months. Coaches can also join our coach register for up to 3 years, and we check with you once a year.
- Contact us about anything in this notice at dpo@io-sphere.io.
1. Who we are
iO-Sphere Limited (company number 14356607) is the controller of your personal data. Our registered address is 102 Middlesex Street, London, E1 7EZ.
Our Data Protection Lead is our Head of IT and Operations. Our recruitment process is run by our People & Culture function.
- Data protection questions or requests: dpo@io-sphere.io
- Questions about your application: careers@io-sphere.io
- Post: Data Protection Lead, iO-Sphere Limited, 102 Middlesex Street, London, E1 7EZ
2. Who this notice covers
This notice applies to anyone who:
- applies for a role with us, whether employed, fixed-term, freelance or contract
- registers interest in future work, for example through our coach register
- is introduced to us by a recruitment agency or executive search firm
- is approached by us about a role, for example through LinkedIn
If you join us, our Staff Privacy Notice takes over. Learners and people enquiring about our courses are covered by our Website Privacy Notice.
If you give a reference for a candidate, we use your name, contact details and what you tell us only to assess that candidate. We keep it for the same period as their application, as set out in section 10.
3. The personal data we collect
| Type | Examples |
|---|---|
| Identity and contact | Name, email, phone number, location, LinkedIn profile |
| Application | CV, employment history (including explanations of any gaps), qualifications, skills, salary or day rate expectations, availability, notice period, the role and type of work you are interested in |
| Screening and interviews | Notes and records from screening calls and interviews, sample delivery or task materials, panel feedback. Where you agree, recordings and transcripts of screening calls |
| Pre-employment checks | Identity and right to work documents, references, qualification checks, your criminal record self-declaration, the outcome of criminal record checks (DBS or overseas equivalent), and any related risk assessment |
| Adjustments | Information you choose to share so we can make reasonable adjustments to the process, which may include health or disability information |
| Equal opportunities monitoring | Optional information about your age range, sex, gender identity, ethnicity, disability, sexual orientation, and religion or belief, if you choose to answer our optional monitoring questions (see section 4) |
| Talent pool and coach register | Specialisms, preferred ways of working, availability, locations, whether you hold a teaching qualification or criminal record check, and how you would like us to contact you |
4. Equal opportunities monitoring
When you apply, we may ask you to answer some optional equal opportunities monitoring questions. They help us check that our recruitment reaches and treats people fairly. Answering is entirely voluntary, every question has a "prefer not to say" option, and your answers will not affect your application.
Your answers are stored separately from your application and are not seen by anyone assessing you. We use them only in aggregated form to report on the diversity of our applicants and hires, and we do not report figures where numbers are small enough to identify someone.
5. How we use your data and our lawful basis
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Assessing your application, arranging interviews and communicating with you | Steps before entering a contract with you, once you have applied (Article 6(1)(b)); our legitimate interest in recruiting suitable people (Article 6(1)(f)), including when we approach you before you have applied |
| Reading your CV with software, to list your qualifications and experience and give a simple score against the role's published requirements | Our legitimate interest in assessing every application consistently and promptly (Article 6(1)(f)). You can object at any time by opting out (section 7) |
| Recording and transcribing screening calls so we have an accurate record | Your consent (Article 6(1)(a)). We ask at the start of the call and only start recording if you agree. Saying no will not affect your application, and you can ask us to stop at any time |
| Safer recruitment: references, employment history checks and qualification checks | Our legitimate interest in safeguarding learners and meeting the safeguarding requirements of our funders and Ofsted (Article 6(1)(f)) |
| Checking your right to work in the UK | Legal obligation (Article 6(1)(c)) |
| Criminal record self-declaration and checks | Our legitimate interest in safeguarding learners (Article 6(1)(f)), and legal obligation where a barred list check is required (Article 6(1)(c)), with Article 10 and the Data Protection Act 2018, Schedule 1, paragraph 1 (employment) and paragraph 18 (safeguarding of individuals at risk) |
| Making reasonable adjustments | Legal obligation (Article 6(1)(c)); Article 9(2)(b) and Schedule 1, paragraph 1 (employment) |
| Equal opportunities monitoring | Legitimate interest (Article 6(1)(f)); Article 9(2)(g) and Schedule 1, paragraph 8 (equality of opportunity or treatment) |
| Keeping your details in our talent pool or coach register | Your consent (Article 6(1)(a)), which you can withdraw at any time |
| Defending or bringing legal claims | Legitimate interest (Article 6(1)(f)); Article 9(2)(f) where special category data is involved |
We only carry out the level of criminal record check that a role is legally eligible for. Having a criminal record does not automatically stop you working with us. Our self-declaration form only asks about convictions and cautions that the role's level of check allows us to ask about. We have an appropriate policy document that explains how we protect criminal offence and special category data.
6. Where we get your data from
- From you, through our website forms, email or LinkedIn
- From recruitment agencies or executive search firms that introduce you to us
- From publicly available professional profiles, such as LinkedIn, when we approach you about a role. If we do, we will point you to this notice in our first message. We do not carry out online or social media checks
- From your referees
- From our pre-employment checks provider and the Disclosure and Barring Service, or overseas equivalents
7. Decisions about your application
We do not use automated decision-making or AI to accept or reject applicants. If you tell us you do not have the unrestricted right to work in the UK or would need visa sponsorship, a member of our team will review your application and contact you. Every decision about your application is made by a person.
How software helps us read your CV. When you apply, our recruitment system uses an AI model (Claude, made by Anthropic, running in our own Google Cloud account) to read your CV. It lists your qualifications and your experience, and checks your CV against each requirement published on the job page. The system then gives a simple score in four categories (relevant experience, technical requirements, qualifications and teaching readiness, and fit to the terms of the role), each from 0 to 3 with a one-line reason. The last category comes only from your answers on our form, never from your CV.
The reading is marked "unverified" until a member of our team has checked it against your CV. The score helps us organise applications. It never accepts or rejects anyone, and a person reads every application. Information about adjustments, health or criminal records is never sent to the software.
You can see the same reading and score on your applicant page. If something is wrong, tell us there and a person will reply. You can opt out when you apply, or at any time on your applicant page. A person then reads your CV without the software, and any earlier reading is removed.
Your CV is not used to train the model. Google processes it for us under our Google Cloud agreement, which does not allow our data to be used for training.
Separately, we transcribe screening calls with Otter.ai when you agree, and our staff use an enterprise AI assistant (Claude) to help summarise notes and draft records. A member of our team reviews everything these tools produce.
8. Who we share your data with
Your data is seen only by the people involved in your recruitment, such as the hiring manager, interview panel and People & Culture team. We also use the suppliers below, under written agreements that require them to protect your data and use it only on our instructions.
| Who | Why | Location and safeguard |
|---|---|---|
| Google Cloud | Our recruitment system: storing your application, CV and messages, and the software reading of your CV | UK (London) for storage. The CV reading runs in the European Union, which is covered by UK adequacy regulations |
| Google Workspace | Storing recruitment records, offer letters and contracts | US/EU. Google Workspace data processing terms, with standard contractual clauses and UK addendum |
| Microsoft 365 | Email, Teams interviews and booking calls | EU/UK with limited US support access. Standard contractual clauses with UK addendum |
| Otter.ai | Transcribing screening calls, with your agreement | US. UK Extension to the EU-US Data Privacy Framework, under our enterprise agreement |
| Anthropic (Claude) | AI assistance for summarising notes and drafting records | US. UK Addendum to standard contractual clauses |
| Slack | Internal messages between the hiring team | US. Standard contractual clauses with UK addendum |
| Zinc | References, right to work, identity and criminal record checks | UK. Zinc's own sub-processors are in the UK, EEA and US, with appropriate safeguards for any transfers outside the UK |
| Disclosure and Barring Service, or overseas equivalents | Criminal record checks, through Zinc. The DBS acts as a controller in its own right | UK, or the country issuing the check |
| Advertising roles and receiving applications. LinkedIn also acts as a controller under its own privacy notice | Ireland (UK adequacy), with onward transfers to the US under standard contractual clauses | |
| Recruitment agencies and search firms | Where they introduced you or are running a search for us. They act as controllers in their own right under their own privacy notices | UK |
| Referees | To provide references you have agreed to | Wherever your referee is based |
| Regulators and professional advisers | For example Ofsted, our funders, lawyers or auditors, where the law requires it or to deal with a legal claim | UK |
We never sell your data or share it for marketing.
9. International transfers
Some of our suppliers, and some members of our team, are based outside the UK. When software reads your CV (section 7), this happens in the European Union, which the UK recognises as giving adequate protection.
Our team outside the UK includes colleagues in South Africa who help run our recruitment.
Where your data is transferred outside the UK, we use the UK International Data Transfer Agreement or the UK Addendum to standard contractual clauses, supported by a data protection test, unless the destination is covered by a UK adequacy decision. You can ask for details of the safeguards for a specific supplier at dpo@io-sphere.io.
10. How long we keep your data
| Data | How long |
|---|---|
| Applications that do not lead to a job, and withdrawn applications (including screening, interview and any criminal record information) | You choose when you apply: deleted when your application closes, 6 months after it closes (the default), or 12 months after it closes. You can change this on your applicant page. Deletion is done automatically |
| Screening call recordings and transcripts | Deleted once the screening record is complete, and within 6 months at the latest |
| Coach register | Up to 3 years. We check with you once a year, and if you do not reply to two check-ins we take you off the register |
| Criminal record certificate details | We keep a record of the date, certificate number, level of check and outcome. We do not keep copies of certificates for longer than 6 months. Our checks provider, Zinc, keeps check data in line with its own retention policy |
| Equal opportunities data | Aggregated for reporting. Individual responses are deleted with your application, or kept separately from your staff record if you join us |
| Successful applicants | Moved to your staff record and kept for the length of your employment or engagement plus 6 years |
11. If you do not give us your data
You do not have to give us your data, but we may not be able to consider your application without it. Some checks, such as right to work, references and criminal record checks, are conditions of any offer, so we cannot confirm an offer until they are complete.
12. Your rights
You have the right to:
- ask for a copy of the personal data we hold about you
- ask us to correct inaccurate data
- ask us to delete your data, or restrict how we use it, in certain circumstances
- object to processing based on our legitimate interests
- withdraw your consent at any time, for example to leave our talent pool
- have your data given to you, or another organisation, in a portable format where we rely on your consent or on steps towards a contract
- complain to us, and to the Information Commissioner's Office (see section 13)
You can do most of this yourself on your applicant page. We email you a sign-in link; there is no password. There you can see where your application is, download what we hold, change how long we keep your details, opt out of the software reading, withdraw, or ask us to delete your details.
For anything else, email dpo@io-sphere.io. We will respond within one month. If your request is complex or you make several, we may extend this by up to two further months and will tell you why. We may need to confirm your identity first.
13. Complaints
If you are unhappy with how we have handled your personal data, please tell us first so we can put it right. Email dpo@io-sphere.io or write to the Data Protection Lead at the address in section 1, explaining what happened.
We will acknowledge your complaint within 30 days, look into it, and tell you the outcome.
You can also complain to the Information Commissioner's Office at any time, at ico.org.uk or on 0303 123 1113.
14. How we protect your data
Recruitment records are kept in access-restricted systems and folders, and only the people involved in your recruitment can see them. Criminal record information is shared only with those who need it to make a decision. We use access controls, multi-factor authentication and encryption, and we report personal data breaches to the ICO where the law requires us to. If a breach is likely to put your rights at high risk, we will also tell you directly.
Every CV and document you upload is checked for viruses and harmful content before anyone opens it. Information about adjustments is stored encrypted, and only named people can see it; every time someone looks at it, that is logged.
15. Changes to this notice
We review this notice at least once a year, and whenever our recruitment process, suppliers or the law change. This is version 1.0, last updated October 2026.