Candidate Privacy Notice
Last updated: 31 July 2026
1. Who we are
This notice is provided by Extracellular Ltd ("Extracellular", "we", "us"), a company registered in England and Wales.
- Company number: 13964988
- Registered office: Science Creates Old Market, Midland Road, Bristol, Bristol, BS2 0JZ, United Kingdom
- Registered with the Information Commissioner's Office (ICO), registration number: ZB565675
- Privacy enquiries: dpo@extracellular.com
Extracellular is the data controller for the personal data described in this notice.
2. When this notice applies
This notice explains how we handle your personal data when you apply for a role with us, or when we consider you for one. It applies whether you apply through our careers portal, are introduced by a recruitment agency, or contact us directly.
It applies from the moment we receive information about you, and continues until we delete that information under section 8.
If we offer you a role and you accept, we will give you a separate privacy notice covering your employment.
3. What we collect
Depending on the role and how far your application progresses, we may hold:
Information you give us
- Name, contact details, and location
- CV or résumé, employment history, education, and qualifications
- Cover letter and any application form answers
- Salary expectations and notice period
- Any other information you choose to include
Information we generate
- Interview notes and assessment records
- Results of any technical task or exercise
- Our own notes on your suitability, and the outcome of your application
Information we may collect at offer stage only
- Right to work documentation (for example passport or visa details), which we are legally required to check before you start work
- References from the referees you nominate
Special category information (see section 6)
- Health information, but only if you tell us about a disability or ask for an adjustment to our process
We do not ask for, and ask that you do not send us, information about your health, ethnicity, religion, sexual orientation, political opinions, or trade union membership unless it is directly relevant to an adjustment you need.
4. Where we get your information
Most of it comes directly from you. We may also receive it from:
- Recruitment agencies, where one has introduced you to us
- Referees you have nominated, at offer stage
- Publicly available professional sources, such as a public LinkedIn profile, where we are researching candidates for a role
- Right to work verification services, at offer stage
If we obtain your information from somewhere other than you, we will provide you with this notice within one month of receiving it.
5. Why we use it, and on what basis
| What we do | Why | Lawful basis |
|---|---|---|
| Assess your application and decide whether to progress it | To fill the role with a suitable candidate | Article 6(1)(f) — our legitimate interests in recruiting for our business. We consider this proportionate: you have chosen to apply, and we assess only what is relevant to the role. |
| Communicate with you about your application | To arrange interviews and tell you the outcome | Article 6(1)(f) — legitimate interests, and Article 6(1)(b) where we are taking steps towards a contract with you |
| Make and administer an offer | To enter into an employment contract | Article 6(1)(b) — steps prior to entering a contract |
| Check your right to work in the UK | We are legally required to do this before you start | Article 6(1)(c) — compliance with a legal obligation |
| Keep a record of the application after a decision | To respond to any query or challenge about the decision, and to defend legal claims | Article 6(1)(f) — legitimate interests |
| Consider you for other roles | So we can contact you if something suitable arises | Article 6(1)(a) — consent, which you can withdraw at any time |
Providing the information in section 3 is voluntary, but we will not be able to consider your application without it. We cannot employ you without completing a right to work check.
6. Special category information
If you tell us about a disability or health condition so that we can adjust our recruitment process, we use that information to make the adjustment and to meet our obligations under the Equality Act 2010. Our condition for processing it is Article 9(2)(b) — obligations in the field of employment — read with paragraph 1 of Schedule 1 to the Data Protection Act 2018.
We share it only with the people who need it to arrange the adjustment, and it plays no part in assessing your suitability.
7. Automated decision-making and AI
We do not make decisions about your application by automated means, and we do not use artificial intelligence to screen, rank, or score candidates. Every decision about your application is made by a person.
We do not use your application to train any AI system.
8. How long we keep it
| If your application is unsuccessful | 6 months from the date we tell you the outcome, after which we delete it. We keep it for this period so that we can respond to any query or challenge about the decision. |
| If you consent to us keeping your details for future roles | 12 months from the date of your consent, or until you tell us to stop, whichever is sooner |
| If your application is successful | Your application information becomes part of your employee record and is kept under the retention periods in your employment privacy notice |
| Right to work documents, if you are not hired | Deleted as soon as the recruitment process ends |
| Right to work documents, if you are hired | Kept for the duration of your employment and for two years afterwards, as required by Home Office rules |
You can ask us to delete your information sooner — see section 11.
9. Who we share it with
We use the following providers, who process your personal data on our instructions only and are bound by written contracts requiring them to keep it secure and use it for no other purpose:
| Provider | What they do | Where the data is held |
|---|---|---|
| BambooHR, LLC | Our recruitment and HR platform, including the careers portal | Ireland |
| Microsoft | Email and document storage (Microsoft 365) | United Kingdom |
| Recruitment agencies | Introducing candidates and managing communication. | United Kingdom |
We do not share your application with anyone else, and we do not sell it or transfer it for anyone else's purposes. We may disclose it where we are legally required to, or where we need to establish or defend a legal claim.
10. Transfers outside the UK
- BambooHR holds our data in Ireland, which is covered by UK adequacy regulations, so no additional safeguard is required. Where BambooHR accesses data from the United States, that transfer is made under the UK Extension to the EU–US Data Privacy Framework.
- Microsoft is covered by the EU Data Boundary and the UK Extension to the EU–US Data Privacy Framework.
You can ask us for more detail about these safeguards using the contact details in section 1.
11. Your rights
You have the right to:
- Access the personal data we hold about you, and receive a copy of it
- Rectification — have inaccurate information corrected. This applies to factual errors; it does not extend to our opinion of your suitability, though you can ask us to record that you disagree with it
- Erasure — ask us to delete your information. We will normally do so unless we still need it to defend a legal claim or to meet a legal obligation
- Restriction — ask us to limit how we use your information in certain circumstances
- Object to our use of your information where we rely on legitimate interests
- Data portability — receive certain information in a portable format, where applicable
- Withdraw consent at any time, where we have relied on it — for example, if you asked us to keep your details for future roles
To exercise any of these, contact us using the details in section 1. We will respond within one month, and will tell you if we need longer or need more information to identify your data. There is no charge.
Exercising any of these rights will not affect how we assess your application.
12. Complaints
If you are unhappy with how we have handled your personal data, please tell us first using the contact details in section 1. We will acknowledge your complaint within 30 days and respond as quickly as we can.
You can also complain to the Information Commissioner's Office at any time:
- Website: ico.org.uk/make-a-complaint
- Helpline: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Contacting us first does not affect your right to complain to the ICO.
13. Changes to this notice
We will update this notice when our practices change, and will revise the date at the top.