Applicant Data Protection Notice

Your data is in safe hands

This privacy notice is here to help you understand what data we collect when you apply for opportunities within the OVO Group, why we collect it, and what we do with it. Please read carefully, because it tells you some important stuff about how we handle your personal data, and the steps you can take to look after it.

This privacy notice applies to all job applicants to companies who are subsidiaries of OVO Group Limited (no. 08862063). This includes the companies which run OVO Energy, SSE Energy Services, Boost, Kaluza, CORGI Homeplan, Kantan, and OVO’s international businesses. When we refer to “we”, “us”, and “our”, we mean any one or more of the data controllers within the OVO Group, as appropriate.

This privacy notice supplements – or may be supplemented by – other privacy notices and information we might give you, but it doesn’t replace them.

If you have any questions or concerns about this notice, we can help and we’d like to hear from you. Get in touch anytime: our contact details are at the bottom of this notice.

1.0 What personal data do we collect?

As part of the recruitment process, we collect and use personal data that relates to people applying for jobs with Kaluza. If you’re coming to Kaluza from an inter-company transfer we may connect and share some of your personal data for the purposes of onboarding.

This might include:

Your name, pronouns, age, legal sex
Contact details, including address, email, and phone number
Details of your qualifications, skills, experience, and employment history
Data about how much you’re paid, including benefit entitlements
If you require sponsorship to work in the UK at present, or in the future
Whether you have a disability, which might mean we need to make adjustments to our recruitment process to support you better
Inclusion and diversity data, e.g. gender, ethnic origin, sexual orientation, or religion or belief (This is optional, so you don’t need to give us this data if you’d prefer not to. Take a look at the section ‘Why do we use your inclusion and diversity data?’ for more information on this.)

1.1 If we make you an offer of employment, we will collect and/or review the following data:

Documents used for identification
Data about your proof of residency and right to work in a country
References and details about your employment history
If it’s needed for the role that you’ve applied for, we might also do these checks:
- Directorship Check
- Basic or Enhanced Criminal Record Check
- FCA Check
- Occupational History Check
- Sanctions File Check
- Education History Check
- Adverse Financial Check
- Identity Check
- Professional or Technical Membership Check

1.2 We could collect your personal data in a variety of ways. For example, we might take details from application forms, CVs or covering letters, online recruitment tools or from recruitment agencies, your passport or other identity documents. It could also come from interviews or other forms of assessment.

We might also collect personal data about you from third parties – for example, references from former employers. We’ll only ask them for this data after we’ve made you a job offer, and we’ll let you know that we’re doing this.

We need these details so we can see if you’re right for the role and decide whether to make you a job offer. If you don’t give us the details we need, it might mean we can’t meet our legal obligations, and you may not be able to continue with your application. When it’s optional whether you give us details or not, we’ll always make that clear, so you can decide.

If we offer you a role we’ll collect, store, and use any further information we need to on-board you as an employee.

2.0 Why do we need personal data?

We use data for these reasons:

As part of the recruitment process, before entering into a contract with you. We might also need to use your data if your application is successful, so we can create your contract and enter into a legal agreement with you.
To make sure that we’re meeting our legal obligations. For example, we legally need to check that you’re eligible to work in a country before you start the job.
To meet our ‘legitimate interest’ to use personal data during recruitment and keep records of this. This means we can manage the process, assess whether you’re right for the role, and decide whether to make you a job offer. We might also need the data so we can respond to and defend legal claims.
To make sure we’re monitoring and reporting on diversity when we’re recruiting; and/or
To make reasonable adjustments to the recruitment process, as well as to be sure that we’re meeting the regulatory obligations we have around employment.

3.0 Why do we use your inclusion and diversity data?

We’re working hard to make sure that all groups have equal opportunities for a successful career with us. So we ask people to tell us about their personal characteristics to help us understand who’s applying to join us, and the outcomes of the recruitment process.

Providing this data is completely up to you. It will not be seen by the hiring managers or used to influence whether we hire you. We’ll only use the aggregate data that all candidates share to improve how we recruit and make sure we’re giving everyone equal opportunities.

4.0 How is your personal data transferred outside of the EEA?

If we need to, we or a third party who we share personal data with, might host, store, and handle that personal data outside of the European Economic Area (EEA). For example, we use a company called Ashby– based in the USA – to help with our applicant tracking system.

Also, if you’re applying for a position outside the UK, your data might be transferred to the UK so we can go through the recruitment process.

We’ll only let this happen if we’re sure we have the right safeguards in place to protect your personal data. This means that we will:

make sure that the country that will be handling your personal information has been deemed "adequate" by the European Commission under Article 45 of the General Data Protection Regulation (GDPR), this includes the Data Privacy Frameworkork

include standard data protection clauses approved by the European Commission for transferring personal information outside the EEA when we make contracts with those third parties. These are the clauses approved under Article 46.2 of the GDPR.

5.0 Who has access to personal data?

Your data might be shared with the following:

Kaluza employees who are involved in recruiting for the role. For example, your potential new manager, the People Team, and/or the Legal, Risk, and Security Teams.
Our third-party suppliers, partners, and subcontractors. They provide, review, and/or receive services that help us carry out the recruitment process.
With third parties so we can get references for you, if we make you a job offer. This could include former employers, academic institutions, credit reference agencies, occupational health service providers, criminal records bureaus, and the DVLA.
Third parties who carry out pre-employment screening services for us. We’ll always ask for your consent before we use this type of data.

Third parties who transcribe and record interviews and provide key point summaries. Before you attend the interview, you have the option to opt out of this transcribe service.

6.0 How long will we keep your personal data?

We won’t keep your personal data for any longer than we need to. This means that when we don’t need it anymore, we delete it – it’s as simple as that. The length of time we keep it all depends on why we’re using it and/or what we need to do to comply with the laws around recruitment, employment, or accounting. We could also need to keep it in case of potential or actual disputes and investigations relating to these.

In some circumstances, we might anonymise your personal data and then use it indefinitely. But because it’s been ‘anonymised’, it’ll no longer refer to you and no one will be able to identify you from this data.

7.0 AI in recruitment

7.1 What we do

As part of our recruitment process, we use an artificial intelligence (AI) tool to assist with the initial review of CVs and job applications. This tool helps us assess whether your skills, experience, and qualifications are relevant to the role you have applied for.

Kaluza, as the recruiter defines the job-specific criteria they want assessed, and the system evaluates candidate-provided application data against those criteria, primarily the candidate’s resume. The AI tool does not scrape third-party sources or enrich this feature with external candidate data

The AI tool is operated by a third-party provider who acts as a data processor on our behalf. We have a data processing agreement in place with them, which restricts how they may use any data shared, requires them to maintain appropriate security measures, and prohibits them from using your data for their own purposes.

7.2 Why we use AI

We use AI-assisted screening to:

handle applications consistently and fairly across all candidates;
reduce the time taken to identify candidates whose experience matches the role requirements; and
support our hiring teams in making more informed, objective shortlisting decisions.

The AI tool will not make final decisions about your application. All shortlisting and hiring decisions are reviewed and confirmed by a member of our recruitment team.

7.3 How we protect your personal data

Before your CV or application is passed to the AI tool for analysis, our third party supplier applies a redaction process to remove personal data that is not necessary for assessing your professional suitability. This includes information such as your name, contact details, address (unless location is high priority for the role), and any other identifying information that could lead to bias or is not relevant to the assessment.

7.4 Interview AI tool

If you are invited to interview, we may use an AI-powered note-taking tool to record and transcribe the conversation. This helps our interviewers focus on the discussion and ensures an accurate record is kept for evaluation purposes.

Participation is not a condition of your application. 'Before you submit your application, you will be given the option to opt in/out of our AI tools.

If at any point you would like more information about the AI used during the recruitment process, or if you’re unsure about your choices please contact recruitment@kaluza.com

8.0 The choices and rights you have, when it comes to your personal data

Our contact details are at the bottom of this policy. You can always get in touch to ask that we:

Let you know if your personal data is being used
Give you more details about how we use your personal data
Give you a copy of any personal data we hold about you
Withdraw your consent for a way that we’re using your data (where we need your consent legally to use your personal data)
Consider any valid objection you have to us using your personal data (including the right to object to us using it even where we’re relying on our ‘legitimate interests’ as a legal reason for doing this)
Update or delete personal data that we have about you
Restrict the way we use your personal data
Consider any valid request to give your personal data to a third-party provider of services (this is called data portability)

We will not discriminate against you for exercising your rights.

8.1 Exemptions

However, the requests above might not apply to some personal data, in certain circumstances. We could need to keep using your personal data because of our legitimate interests or to meet a legal obligation.

8.2 Response

If an exemption applies, we’ll tell you when we reply to your request. We might ask you to give us some data to confirm your identity before we reply.

9.0 Getting in touch with us

9.1 Our contact details

If you’ve got any questions about data protection, you’d like to raise a ‘rights request’, or you’re not happy with how we’ve handled your data, please just get in touch using these details:

Country
Contact details
UK, US, Australia, France
recruitment@kaluza.com

If you’d like to raise a ‘rights request’, let us know this as part of your message. This will help make sure it goes to the right place. Please include if there’s any data you’re especially interested in, if you can. This will make it easier for us to reply to you properly.

9.2 Data Protection Officer (DPO)

You can email our Data Protection Officer (DPO) at dataprotection@kaluza.com

9.3 Your regulator

If you’re not happy with our reply to any complaint or you think the way we’ve used your data doesn’t comply with data protection law, you can make a complaint to your data protection regulator.

9.3.1 Information Commissioner’s Office (ICO)