Barrows Connected Store Candidate Privacy Policy

Last updated: September 2026

Thank you for your interest in a career with Barrows. When you apply for a role with us, are sourced or referred as a candidate, whether as an employee, worker or contractor, or provide a reference for someone applying to Barrows, you trust us with information about you. This policy explains what information we collect, why we collect it, how we use and share it, and the rights and choices you have.We aim to keep this policy short and clear. If anything is unclear, please contact us using the details at the end.
‍
1. Who we are
‍
In this policy, "Barrows", "we", "us" or "our" means the Barrows Group of companies you are applying to or interacting with, including:Barrows Connected Store US Inc., a Delaware corporation;
Barrows Connected Store UK Limited, incorporated in England and Wales (company number 06041112);
Barrows Connected Store Studio (Pty) Limited, incorporated in South Africa (reg. number 2024/422340/07),and our group companies worldwide.The Barrows entity you are applying to is the controller of your personal information (the "responsible party" under South African law). Where more than one Barrows entity is involved in your application (for example, a regional recruiter supporting a hire in another country), those entities act as joint controllers.
‍
2. What information we collect
‍
We collect only the personal information we need to assess your application and, if successful, to offer you a role. This typically includes:

We may also receive information about you from third parties, such as recruitment agencies, executive search firms, background check providers, assessment providers, professional networks (e.g. LinkedIn Recruiter), referees you have named, and Barrows employees who refer you.

‍Providing your information. Some information is required for us to consider your application (for example, your CV and right-to-work documents). If you choose not to provide it, we may not be able to progress your application. Other information (such as diversity data) is entirely voluntary.

3. Why we use your information and our legal grounds
‍
We use your personal information for the following purposes:

• To manage your application. Reviewing your CV, arranging interviews, conducting assessments, communicating with you about the role, and making a hiring decision.
• To verify your identity and right to work. As required by law in the country where the role is based.
• To carry out background checks. Where lawful, proportionate and relevant to the role, and with notice to you.
• To keep you informed of other opportunities. Where you have asked us to, or where we have a legitimate interest in doing so and you have not objected.
• To improve our recruitment process. Analysing anonymised or aggregated data on how our recruitment is performing.
• To meet our legal, regulatory and reporting obligations. For example, immigration, tax, equal opportunities, and audit requirements.
• To establish, exercise or defend legal claims. For example, in response to a complaint or dispute.

Depending on where you are based, we rely on the following legal grounds to process your information:

• Taking steps at your request before entering into a contract. Processing your application and progressing you through selection.
• Our legitimate interests. Running a fair, efficient and effective recruitment process; keeping records of applications; improving our processes; and protecting Barrows, our people and our clients. We balance these interests against your rights and only rely on this ground where our interests are not overridden by yours.
• Compliance with a legal obligation. For example, immigration checks and equal opportunities monitoring where required.
• Your consent. For example, where you agree to us keeping your CV on file for future roles, or where we ask you to complete a voluntary diversity survey. You can withdraw your consent at any time.

4. Sensitive and special category information

‍Some information we may collect is treated as more sensitive under the law — for example, information about your health or disability, racial or ethnic origin, religious beliefs, sexual orientation, trade union membership, or criminal record. In South Africa, this also includes information about children.

We only process this information where:

• You have given your explicit consent (for example, in a voluntary diversity survey, or when you tell us about a health condition so we can make reasonable adjustments during the recruitment process);
• It is necessary for employment, social security or social protection law (for example, disability accommodations, or diversity monitoring required by regulators);
• It is necessary for us to establish, exercise or defend a legal claim;
• You have deliberately made the information public; or
• Another lawful ground applies under UK GDPR, US state law, or POPIA.

We do not use voluntary diversity information to make hiring decisions. It is used only in aggregated and anonymised form for diversity monitoring and reporting.

‍5. Who we share your information withWe share your personal information only where necessary and only with parties that provide appropriate protection for it. The categories of recipients are:

• Barrows group companies. For example, where interviewers, HR, hiring managers or approvers sit in a different country from the role.
• Service providers. Including our applicant tracking system provider (Bamboo HR LLC, https://www.bamboohr.com/), recruitment platforms, assessment providers, background check providers (Zinc Work Limited, https://zincwork.com/), IT and cloud hosting providers, and professional advisors. These providers act on our instructions ("processors" under UK GDPR; "operators" under POPIA; "service providers" under US state privacy law) and are contractually required to protect your information.
• Referees. Where you have provided their details so we can obtain a reference.
• Recruitment and search agencies. Where they have introduced you to us.
• Clients and partners. Only where a role requires client vetting or security clearance, and only with your knowledge.
• Regulators, courts, law enforcement and other authorities. Where we are required or permitted by law to do so.
• Prospective buyers or investors. If all or any part of Barrows is sold, transferred, restructured or merged, on terms that protect your information.

We do not sell your personal information, and we do not share it with third parties for their own advertising or marketing purposes.

‍6. International transfersBarrows operates globally. Your personal information may be transferred to, stored in, or accessed from countries other than the one where you applied, including the United States, the United Kingdom, South Africa, and other countries where our group companies and service providers operate.

Where we transfer personal information out of the UK or European Economic Area, we rely on:

• transfers to a country that has been recognised as providing an adequate level of protection; or
• Standard Contractual Clauses and/or the UK International Data Transfer Agreement (or UK Addendum), together with any additional safeguards required following a transfer risk assessment.

Where we transfer personal information out of South Africa, we do so in accordance with section 72 of POPIA. For example, where the recipient is subject to a law, binding corporate rules or a binding agreement that upholds principles substantially similar to POPIA, where you have consented, or where the transfer is necessary for the performance of a contract with you.

You may contact us for more information about the safeguards we use.

‍7. How we protect your informationWe use appropriate technical, organisational and physical measures to protect your personal information against loss, misuse, and unauthorised access, alteration or disclosure. These include access controls, encryption of data in transit and at rest where appropriate, secure hosting, staff training, and vendor due diligence. Despite our efforts, no system is entirely secure. Please contact us immediately if you believe your information has been compromised.

‍8. How long we keep your informationWe keep your personal information only for as long as we need it:

• If your application is unsuccessful, we generally keep your application information for 12 months after we notify you of the outcome, so we can respond to any queries or complaints and consider you for other suitable roles. We will delete it sooner if you ask us to.
• If you ask us to keep your CV on file, we will keep it for the period you have agreed to (typically up to 12 months), and delete it earlier if you withdraw your consent.
• If your application is successful, we transfer your information to your employee file. Our Employee Privacy Policy will then apply, and we will provide this to you as part of your onboarding.
• Where we are required to keep information for longer, for example, to meet a legal, tax or regulatory obligation, or to defend a legal claim, we will retain it for the period required and then securely delete or anonymise it.

9. Your rights and choicesSubject to the law that applies to you, you have the following rights in relation to your personal information:

• Access: request a copy of the personal information we hold about you.
• Correction: ask us to correct information that is inaccurate or incomplete.
• Deletion / erasure: ask us to delete your information where there is no good reason for us to keep it.
• Restriction: ask us to pause our use of your information while a concern is being resolved.
• Objection: object to our use of your information where we rely on our legitimate interests.
• Portability: ask us to provide certain information in a portable format, or to transfer it to another controller.
• Withdraw consent: where we rely on your consent, you can withdraw it at any time. This does not affect the lawfulness of anything we did before you withdrew.
• Complain: lodge a complaint with your data protection regulator (see the region-specific notices below).

To exercise any of these rights, please contact us using the details in Section 11. We will respond within the timeframes required by law and will not charge a fee except where permitted. We may need to verify your identity before we act on your request. In some cases we may refuse a request where the law allows. If that is the case, we will explain why.
‍
10. Region specific notices
‍
10.1 United Kingdom
‍
Our processing of your personal information is governed by the UK GDPR and the Data Protection Act 2018. The controller for your personal information is Barrows Connected Store UK Limited. If you are not happy with how we handle your personal information, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk, by phone on 0303 123 1113, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. We would appreciate the chance to address your concerns first. Please contact us using the details in Section 11 below.
‍
10.2 United States
‍
Our processing of your personal information is governed by applicable US federal and state law. This section applies to candidates in the United States and provides additional information for residents of California and other states with comprehensive privacy laws (including Colorado, Connecticut, Virginia, Utah, Texas, and others as applicable).Categories of personal information we collect. In the last 12 months, we have collected the categories listed in Section 2, which map to the following categories under the California Consumer Privacy Act (CCPA/CPRA): identifiers; personal information under Cal. Civ. Code §1798.80(e); characteristics of protected classifications (voluntary diversity information); professional or employment-related information; education information; internet or electronic network activity; and, where relevant to the role, sensitive personal information (such as government identifiers, right-to-work documentation, and, with your consent, health or disability information).Sources, purposes and disclosures. These are described in Sections 2, 3, and 5 above.Sale and sharing. We do not sell your personal information, and we do not share it for cross-context behavioural advertising, within the meaning of the CCPA/CPRA or similar state laws.Retention. See Section 8.Your rights. If you are a California resident, or a resident of another state with a comprehensive privacy law, you have the right to know what personal information we collect and how we use it, to access and receive a copy, to correct inaccurate information, to request deletion, to opt out of sale/sharing and certain profiling, and to limit our use of sensitive personal information. You also have the right not to be discriminated against for exercising these rights. To exercise your rights, contact us using the details in Section 11. An authorised agent may submit a request on your behalf; we will require verification.Background checks. Where we obtain a consumer report or investigative consumer report about you (for example, a background check under the Fair Credit Reporting Act), we will provide you with the required disclosures and obtain your written authorisation before doing so.
‍
10.3 South Africa
‍
Our processing of your personal information is governed by the Protection of Personal Information Act, 2013 ("POPIA"). The responsible party is Barrows Connected Store  SA (Pty) Ltd.We process your personal information in accordance with the eight conditions for lawful processing under POPIA: accountability; processing limitation; purpose specification; further processing limitation; information quality; openness; security safeguards; and data subject participation.

Our Information Officer can be contacted at privacy@barrowscs.com.

If you believe we have not handled your personal information in accordance with POPIA, you have the right to complain to the Information Regulator (South Africa):Website: inforegulator.org.za
‍
Email: complaints.IR@justice.gov.za / POPIAComplaints@inforegulator.org.za
Post: 27 Stiemens St, Braamfontein, Johannesburg, 0001We would appreciate the chance to resolve your concerns first. Please contact us using the details in Section 11 below.

• Website: inforegulator.org.za
• Email: complaints.IR@justice.gov.za / POPIAComplaints@inforegulator.org.za
• Post: 27 Stiemens St, Braamfontein, Johannesburg, 0001

We would appreciate the chance to resolve your concerns first. Please contact us using the details in Section 11 below.

‍11. Contact us

‍If you have any questions about this policy, want to exercise any of your rights, or want to raise a concern about how we handle your personal information, please contact us:

• Data Protection Manager (UK/EU): privacy@barrowscs.com 
• Information Officer (South Africa): privacy@barrowscs.com 
• Privacy contact (US): privacy@barrowscs.com 
• Post: 40 Churchway, London, United Kingdom, NW1 1LW

12. Changes to this policy

‍We may update this policy from time to time to reflect changes in the law, in our recruitment practices, or in the services we use. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you directly. Please check this page from time to time to stay informed.