Privacy policy for Candidates
Date of publication: 07-09-2026
1. Introduction
1.1 Jellycat Limited (the “Company”/we/us) is committed to protecting your personal
information.
1.2 This privacy notice sets out how we collect and use your personal information in accordance
with the UK General Data Protection Regulation and the Data Protection Act 2018 ("Data
Protection Law").
1.3 This privacy notice applies to candidates only. If you are recruited by the Company, we will provide you with a separate staff privacy notice.
2. Data controller and contact details
2.1 We are the data controller for your personal data. This means we are responsible for deciding what personal information we collect, hold and use about you. We are also responsible for deciding how and why that personal information is used.
2.2 We have appointed a Data Protection Officer (DPO) to oversee compliance with Data Protection Law. Contact details for the DPO are set out below. If you have any questions about this privacy notice or how we handle your personal information, please contact the DPO.
Name: Lewis Silkin LLP, 255 Blackfriars Rd, London SE1 9AX
Email address: DPO@Jellycat.com
2.3 If you are located in the European Economic Area (EEA), you may also contact our EU
Representative regarding matters relating to your personal data.
Our EU Representative (appointed under Article 27 of the EU General Data Protection
Regulation) is:
Name: Lewis Silkin LLP
Email address: EURep.Jellycat@Lewissilkin.com
3. What information do we collect?
3.1 We collect, store and use the following categories of personal information about candidates:
(a) Personal contact details such as name, title, address, telephone number and email
address.
(b) Gender.
(c) If you are applying for a role as an employee or worker, recruitment information
(including your CV, interview notes, application questionnaire, references,
qualifications, employment history and any other information collected as part of
the application process).
(d) If you are applying for a role as a contractor, information about your work experience
such as previous projects worked on, qualifications, notes from discussions relevant
to the work required and any other information collected as part of the application
process.
(e) If you are invited to attend a final stage interview, we will ask you to provide your
passport and/or other documentation necessary to prove your right to work in the
relevant jurisdiction.
3.2 If your application is successful, we will then collect, store and use additional personal
information in accordance with the Company’s staff privacy notice.
3.3 We do not collect, use or hold information about criminal convictions.
4. How do we collect your personal information?
4.1 We collect most of your personal information directly from you, through the application, recruitment and, if you are successful, onboarding process. If you are applying to work as a contractor, we may collect your information when negotiating and entering into a contract for services with you.
4.2 Depending on the type of work you are applying for, we may also collect your information from a recruitment or employment agency, former employer/chosen referee, credit reference check agency or other background check agency.
5. How do we use your personal information?
5.1 We will only use your personal information when we are allowed to under Data Protection Law. The most common reasons for using your personal information are:
(a) When necessary in relation to your prospective employment contract, contract for
services or other contract with us. This includes information needed to process your
recruitment or appointment application, negotiate and, if applicable, enter into a
contact with you.
(b) When necessary to comply with a legal obligation, such as checking you have the
legal right to work in the UK if you successfully apply for a role as an employee or
worker.
(c) Where necessary to pursue a legitimate interest of either the Company or a third
party, provided your interests and rights do not override that legitimate interest.
Examples include assessing your skills, qualifications and suitability for the work,
keeping records related to our hiring processes and, if applicable, carrying out
background and reference checks for successful candidates.
5.2 Some of these reasons will overlap, and there may be several reasons we use your personal information.
5.3 We will only use your personal information for the reason we first collected it, unless we reasonably think we can use it for another, compatible reason. If we need to use your personal information for another, unrelated purpose, we will notify you and explain the reason why.
5.4 We do not need your consent to use your personal information where we are otherwise allowed to under Data Protection Law. We also do not need your consent to process your special category data (see below), as long as we meet one other additional condition under Data Protection Law. It will never be a condition of any contract of employment or other contract for services with us that you agree to any request for consent that we might make. If you are asked and provide your consent, you can withdraw it at any time.
6. How do we use your special category personal data?
6.1 Special categories of more sensitive personal information require additional protection, and we need to meet additional conditions to be able to collect, use and hold it. Further information about the measures we take when using employee special category data is set out in our Employee Privacy Policy.
6.2 Situations where we might process your special category data might be: if you successfully apply for a role as an employee or worker, and we need check your right to work in the UK as part of our obligations under employment law or we use information about a disability to consider whether we need to make appropriate adjustments during the recruitment process such as during an interview.
7. Who do we share your personal information with?
7.1 We may share your personal information with the following third parties, for the purposes of processing your application, such as carrying out background checks or transferring details to another Jellycat entity. All out third-party service providers and other entities in the Jellycat group are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.
8. Data Security
8.1 We have put in place appropriate security measuresto prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third-parties who have a business need-to-know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality.
9. International transfers
9.1 We do not envisage that we will transfer employee personal information outside the UK. Any intragroup data transfers, i.e. where data is transferred from one Jellycat entity to another for business administrative purposes, will always be done lawfully and in accordance with applicable data protection laws.
10. How long do we store your personal information for?
10.1 We will only keep your personal information for as long as we need to. For successful applicants, details of the retention periods that we will apply to different types of personal information are available in our staff privacy notice. For unsuccessful applicants, your personal data will be erased within 12 months of the date we communicate our decision to you.
11. Automated decision making
11.1 We may use automated systems, including AI-driven tools, to support initial screening decisions. This is limited to ensuring that all candidates have a right to work in the UK and ensuring that candidates have certain specific qualifications that are expressly required for a particular role. If you do not tick ‘Yes’ to these questions (asking if you have a required qualification or the right to work in the UK), the application is rejected.
11.2 Where an application has been rejected following the use of an automated system, you will be informed of this rejection. You have the right to request information about how automated tools were used in this process, the right to request human overview of this decision and the right to contest the decision. If you wish to exercise any of those rights, please contact
Recruitment@Jellycat.com and/or DPO@Jellycat.com
11.3 If we make an automated decision on the basis of any sensitive personal information, we must have either your explicit written consent or it must be justified in the public interest, and we must also put in place appropriate measures to safeguard your rights.
12. Your data rights
12.1 In certain circumstances, under Data Protection Law, you have the right to make a Data Subject Request which includes the right to:
(a) Request access to and receive a copy of your personal information (known as a data
subject access request or DSAR).
(b) Request that we correct or complete any inaccurate or incomplete personal
information that we hold about you.
(c) Request that we delete or remove personal information that we hold about you
(known as the right to be forgotten).
(d) Request that we restrict our processing of your personal information, so we can
store but not use it except in certain circumstances.
(e) Request that we transfer your personal information to another data controller.
(f) Object to us processing your personal information. This right is absolute if we are
using your information for direct marketing.
12.2 If you wish to exercise any of your data rights, please contact the DPO at DPO@Jellycat.com.
13. Complaints
13.1 If you would like to complain about (a) the way that your personal data has been processed by us, (b) the way that we have responded to an issue you have raised regarding your data protection rights or (c) the way we have responded to a Data Subject Request, please contact us at DPO@Jellycat.com.
13.2 We will acknowledge receipt of your complaint no later than 30 days from receipt.
13.3 We will investigate the complaint without undue delay. That investigation may include obtaining information from different departments in the company or seeking further information from you.
13.4 We will take the appropriate steps to respond to the complaint, including making any necessary internal enquiries. We will keep you reasonably informed as to the progress of the investigation.
13.5 Once the investigation is complete, we will inform you of the outcome of the complaint without undue delay.
13.6 You also have the right to make a complaint at any time to the Information Commissioner’s
Office (ICO) with respect to data protection issues.
