Privacy Notice for applicants for vacancies

About us

We’re Khulisa (which means ‘to nurture’ in Zulu), a national youth and rehabilitation charity dedicated to helping young people and adults with complex needs to live healthier, crime-free lives. Khulisa is a registered charity (no. 1120562) and company limited by guarantee (no. 6210432). We deliver emotional and social wellbeing programmes, therapeutic support and mentoring to young people and adults with complex needs in schools, prisons and the community. We also deliver training on the effects of trauma to professionals working with these young people and adults, such as teachers, prison officers and social workers.

This privacy policy sets out:

  • when and why we collect personal data and other information about you;
  • how we use that information;
  • the conditions under which we may disclose this to others;
  • how we keep the information secure; and
  • the rights you have over the personal data we collect.

This privacy notice is made under Articles 13 and/or 14 of the General Data Protection Regulation (GDPR).

Contacting us

If you have any questions regarding this privacy policy, these can be sent to our Data Protection Officer via our contact form on our website, by email with ‘privacy policy’ in the subject to or by post.

Your letter should be addressed to our registered office address:
The Data Protection Officer
30A Acre Lane


Why and how do we collect information about you?

We collect information about you when you send through your application to us. We will need to maintain and process data about you for the purposes of reaching and communicating a recruitment decision and production of an offer of employment if appropriate. 


What information do we collect?

Processing at the recruitment stage includes the collection, storage, retrieval, alteration, disclosure or destruction of data. The personal information we collect might include:

  • Interview details including notes of interviewers, dates and times
  • Candidate’s work history
  • Qualifications and experience relevant to the role
  • Ethnic origin (for monitoring purposes only)
  • Disabilities (for monitoring and adjustments only)
  • Date of birth (for post employment health checks and adjustments advice only)
  • Contact details, including addresses, phone numbers and other contact details including historical address records for staff vetting and ID verification
  • Criminal records (only where relevant to role and where legally permitted)
  • Court judgements and directorships (only where relevant to role and where legally permitted)
  • References provided by previous employers and personal or educational referees
  • National insurance number
  • Rights to work information for example copies of passports, ID cards, residence permits
  • Documents to confirm identity and address for example the above and utility bills, bank statements

The data is collected by us and stored in our secure data processing system as explained below. 

How do we use the information we collect?

The data we hold may be held and processed to meet our legal responsibilities and also for the purposes of management and administration of an offer of employment, ascertaining suitability for employment, to comply with equal opportunity, immigration and money laundering legislation and, from time to time, the need to disclose data it holds about you to relevant third parties (or example where legally obliged to do so by HM Revenue and Customs, UK Border or other public authority, or where requested to do so by yourself for the purpose of giving a reference).

  • Tailor the content of our training and organise any necessary logistics;
  • Provide you with resources relevant to the services and provide links to our monitoring and evaluation surveys;
  • Measure the impact of our training and other services;
  • Track the number of professionals we have worked with over a given period and in a given location;
  • Report to the organisations which fund our work or work with us in other ways on our progress in delivering training and other services;
  • Give a progress report and recommendations to the organisation partnering with us to organise the training and other services.

However, we will always treat your data confidentially and will not disclose your identity in our reporting or sharing with third parties other than the organisation partnering with us to organise the training and/or other services in some circumstances. Third parties providing a service to Khulisa may also be able to access the information we collect about you under certain circumstances, detailed below.

We take steps to ensure that all personal information we collect is treated securely. Access to our email, document management and storage services is limited to members of Khulisa’s staff, secured via two-step verification or via encrypted and password protected databases.

Who has access to the information we collect?

We will not sell or rent your information to third parties. 

We will not share your information with third parties for marketing purposes.

Khulisa may also share this data with selected third parties, under agreements which strictly govern the use the third party may make of the data, to facilitate the above uses including our nominated occupational health advice provider and our nominated staff vetting provider. In some cases, Khulisa will use automated profiling methods to analyse the above data, including against standard industry benchmarks, but will not use such methods as the sole basis for any related decision making.

In some cases, Khulisa may also hold sensitive data, as defined by the legislation, about you. This could be information about health, criminal convictions and financial debts and directorships.

In the event of a sale, business restructure or reorganisation of some or all of our business and assets to any third party, we will take steps with the aim of ensuring that your privacy rights continue to be protected.

How long will we keep the information?

We review our retention periods for personal information on a regular basis. We will hold the personal information we collect about you for as long as is necessary for the relevant activity. We keep data for 5 years and then anonymise this data.

International transfers

Some of the personal information we collect may be transferred and stored securely outside of the UK and European Union by the suppliers of our online surveys and email, document management and storage services. Where that is the case, safeguards are in place to ensure legal protection under the GDPR. This includes supplier certification under the Privacy Shield Scheme if based in the United States of America, or reliance on Model Contract Clauses.

Legal basis of processing

Under the GDPR, we process your personal data under the legal basis that this falls within our legitimate interests as an organisation providing training and other services to organise our services effectively, and take steps to measure the impact of our services.

Your rights

You have the right to ask for a copy of the information Khulisa hold about you. To do this, please make a request in writing (via our contact form on our website, by email or by post) to the Data Protection Officer and we will provide a response within 30 days.

Your rights under the GDPR also include the following:

  1. Right to rectification: This means you may ask us to rectify any of the personal data we hold about you.
  2. Right to object: You have the right to object to us processing the data we hold for you. In this event, we will stop processing any more information unless we can show legitimate grounds for the processing of this information.
  3. Right to restrict processing: You have the right in certain circumstances (for example, where accuracy is contested) to request that the processing of the personal data we hold about you is restricted.
  4. Right to erasure (sometimes known as the right to be forgotten): If you object to us processing the data we hold for you, and Khulisa cannot show legitimate grounds for processing this data, you have the right to request us to delete the personal data we hold for you.


If you consider that the personal data we hold for you has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator. 

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts. 

The Information Commissioner can be contacted at:

By email:

By phone: 0303 123 1113

By post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow. Cheshire. SK9 5AF

* indicates required