Candidate Privacy Notice

Last updated: 23rd October 2025

The Arch Company's approach to privacy

The Arch Company Services Limited (which forms part of The Arch Company group) and its owners Blackstone (together, “Arch Co” or “we”) are committed to protecting your privacy and processing your personal data fairly and lawfully.

This candidate privacy notice (“Privacy Notice”) applies to any processing by Arch Co of the Personal Data of candidates who send their Curriculum Vitae (“CV”) to Arch Co or who otherwise participate in selection procedures aimed at establishing employment or services relationships with Arch Co (“Candidate” or “you”).

Personal Data means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data). There are ‘special categories’ of more sensitive personal data which, for example, includes information about your racial or ethnic origin, your health, and your religious belief, which we shall call “Special Category Data” in this Privacy Notice.

When we say processing we mean almost any handling or use of Personal Data, including (but not limited to) collection, recording, organisation, modification, transfer, and deletion.

When we say controller we mean a legal or natural person, agency, public authority, or any other body who, alone or when joined with others, determines the purposes of any Personal Data and the means of Processing it.

The Arch Co entity to which you have applied is the "controller" of your Personal Data.

See the section at the end of this Privacy Notice for the relevant contact details.

A summary of the key elements of this Privacy Notice are shown below.

This Privacy Notice explains:

1. what Personal Data we collect and why we collect it
2. how we collect your Personal Data
3. how long we keep your Personal Data
4. who has access to and how we may disclose your Personal Data
5. international transfers of Personal Data
6. your rights, such as how you can access and update the Personal Data we hold about you
7. how we protect your Personal Data
8. automated decision making
9. changes to this Privacy Notice
10. who to contact

1. What Personal Data we collect and why we collect it

We process the following types of Personal Data about you

a) Identification Details such as name, surnames, address, date of birth, country of residence, nationality, national insurance number, passport or ID, your photo;

b) Contact Details such as address, phone number, and e-mail;

c) Work Details such as educational background, knowledge of languages, professional skills completed, professional experience in previous jobs (including job titles, description of previous jobs, reasons for leaving previous jobs, leaving dates, disciplinary and grievance information and any information related to professional conduct matters), information related to working arrangements, retirement eligibility and information related to terms of employment or engagement;

d) Immigration Data such as citizenship and/or residency, visa number, work permit details;

e) Recruitment Data such as interview and assessment data (including interview notes and recordings, assessment participation, any offers and counter-offers, and the outcome of the recruitment process), data related to visits to premises (such as CCTV or access logs), access to systems, software, websites and applications as part of the recruitment process.

In addition, to the extent permitted by law, we may process Special Category Data, such as data relating to your health status; racial or ethnic origin or religious beliefs. This will only be to the extent that such information is included in the CV or application and is necessary for the eventual establishment of the employment or collaboration relationship, as it is strictly related to our legal obligations that cannot be fulfilled otherwise or is otherwise voluntarily disclosed by you during the recruitment process.

To the extent we are legally permitted to do so and in accordance with applicable laws, we may also process information about alleged or actual criminal activity (for example, DBS checks).

We have set out below, in a table format, a description of how we use your Personal Data, and which of the lawful bases we rely on to do so (as required by the UK data protection laws). We have also identified what our legitimate interests are, where appropriate.

Please contact us if you need details about the specific lawful basis we are relying on to process your Personal Data where more than one ground has been set out in the tables below.

We may seek your consent to certain processing which is not otherwise justified under one of the above basis. If consent is required for the processing in question, it will be sought from you separately to ensure that it is freely given, informed and explicit. Information regarding such processing will be provided to you at the time that consent is requested, along with the impact of not providing any such consent. You should be aware that it is not a condition or requirement of your recruitment to agree to any request for consent from Arch Co.

2. How we collect your Personal Data

We usually collect your Personal Data directly from you as part of the recruitment and selection process, including through the submission of your CV, electronic mail or any other available application channel.

We may also obtain your Personal Data indirectly from third parties such as references from previous employers, employment agencies, recruiters or similar entities.

3. How long do we keep your Personal Data?

Your Personal Data will be kept for the period of time necessary for the purposes for which such Personal Data were collected, as set out in this Privacy Notice.

In any event, Candidates' Personal Data shall be kept for a period equal to the duration of the selection process and:

• if the application is unsuccessful, for up to 12 months after your last contact with Arch Co, unless a longer retention period is required by law; or
• in the event of a successful application and subsequent employment, for the duration indicated in the Employee Privacy Notice that will be provided to you at the time of employment.
At the end of the retention period, Personal Data will be deleted or anonymised.

4. Who has access to and how we may disclose your Personal Data?

We may disclose your Personal Data to the following categories of persons:

• other companies in the Arch Co group and its owners for the purposes set out in this Privacy Notice;
• service providers, agents, subcontractors, and other entities that support Arch Co activities (e.g., consultants, appraisers, lawyers, accountants, cloud service providers, hosting, email and content providers, and administrative service providers);
• entities that are transferees of a company or business unit, companies resulting from possible mergers, demergers, or other transformations of Arch Co; and/or
• to any public body, judicial authorities and supervisory authorities, where permitted or required by law or regulation.
When we rely on service providers, we only disclose to them the Personal Data necessary for the provision of the requested service and we enter into a contract with them that requires them not to use the Personal Data except in accordance with our specific instructions and to comply with appropriate security measures.

5. International transfers of Personal Data

All Arch Co group companies are based in the UK and process personal data in the UK.

However, your Personal Data may be transferred to third parties (e.g. service providers providing services to Arch Co group companies) who may have systems or suppliers located outside of the UK. This means that such third parties will be processing your Personal Data outside of the UK. We will ensure that any such international transfers are made subject to appropriate or suitable safeguards as required by applicable data protection law, in particular the Standard Contractual Clauses approved by the European Commission, with the UK addendum thereto as appropriate, and supplemented by additional contractual, organisational and security measures as necessary.

You have a right to request a copy of the appropriate measures we put in place.

6. Your Rights

It is important that the Personal Data we hold about you is accurate and current. Please keep us informed if any information changes during your working relationship with us.

You have several rights in relation to your Personal Data. In certain circumstances these rights may not be absolute, which we can discuss with you further where relevant. You are not required to pay a charge in most circumstances for exercising your rights and we generally have one month to respond to your request.

We ask for proof of ID where we need to confirm the identity of the individual making the request to comply with our security obligations and prevent unauthorised disclosure of data.

You can make such a request to exercise any of your data subject rights by sending us an email to data.protection@thearchco.com or the HR department (HR@thearchco.com) as detailed in the table at the end of this Privacy Notice.

(a) Right to access and rectify Personal Data

You may request a copy of your Personal Data from any Arch Co group company which may hold Personal Data about you. You can also ask us to correct any inaccuracies in your Personal Data though we may need to verify the accuracy of the new data you provide to us.

We may refuse to provide you with a copy of your data in certain circumstances, for example, if your request is manifestly unfounded. If we refuse your request, we will explain the reason for refusing it.

(b) Right to erase Personal Data

You have the right to ask us to delete or remove Personal Data where there is no good reason for us to continue processing it. You also have the right to ask us to delete or remove your Personal Data where you have successfully exercised your right to object to processing (see below), where we may have processed your data unlawfully or where we are required to erase your Personal Data to comply with applicable law.

If you ask us to delete your information, we may not be able to do so, for example due to regulatory and contractual constraints which will be notified to you, if applicable, at the time of your request. For example, we may need to retain certain Personal Data about you if required for us to comply with a legal obligation or for the establishment, exercise or defence of legal claims.

(c) Right to object to processing of your Personal Data

You have the right to object to processing where we are relying on our legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. In such case, we must stop that processing unless we can either demonstrate legitimate grounds for the processing that override your interests, rights, and freedoms or where we need to process your Personal Data for the establishment, exercise, or defense of legal claims.

(d) Right to restrict the processing of your Personal Data

This enables you to ask us to restrict (i.e., retain without using) the processing of your Personal Data in the following scenarios:

(i) if you want us to establish the data’s accuracy;
(ii) where our use of the data is unlawful but you do not want us to erase it;
(iii) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or
(iv) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

(e) Right to data portability

You have the right to request the transfer of your Personal Data to you or to a third party. We will provide to you, or a third party you have chosen, your Personal Data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the Personal Data to perform a contract with you.

(f) Right to withdraw consent to processing

You have the right to withdraw consent at any time where we are relying on consent to process your Personal Data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent.

(g) Right to complain

We welcome the opportunity to attend to any of your concerns or complaints about the way in which we handle your Personal Data, however you also have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues: https://ico.org.uk/global/contact-us/

7. Protecting your Personal Data

We are committed to keeping secure the Personal Data you provide to us. We take all reasonable precautions to protect the Personal Data we hold about you from misuse and loss and from unauthorised access, modification or disclosure. Such measures include using industry-standard administrative, technical, and physical safeguards to protect your Personal Data against loss, theft, misuse, unauthorized access, modification, disclosure, and destruction.

8. Automated decision making

We do not carry out any automated decision making or profiling of employees that produces a legal effect or similarly affects employees. If this changes, we will inform you of this.

9. Changes to our Privacy Notice

This notice will be reviewed periodically and as a result may be updated. All information held by us will be governed by the most recently updated notice.

10. Who to contact

If you have any questions or concerns concerning this Privacy Notice, please contact us using the relevant contact details below.