Privacy Notice
We understand that the privacy and the security of your personal information is extremely important. This notice sets out what we do with your personal information, what we do to keep it secure, from where and how we collect it, as well as your rights in relation to the personal information we hold about you.
If you don’t want to read all the detail, here are the things we think you’d really want to know:
- Your personal information is, where appropriate, shared within the Sainsbury’s Group.
- We do use a number of third parties to process your personal information on our behalf and some of them are based outside of the United Kingdom.
- You have a number of rights over your personal information. How you can exercise these rights is set out in this notice.
Who are we?
When we say ‘we’ or ‘us’ in this policy, we’re referring to the separate and distinct legal entities that make up the Sainsbury’s Group from time to time.
What sorts of personal information do we hold?
Personal data means any information about an individual from which that person can be identified, or which relates to that individual. It does not include data where the identity has been removed (e.g. anonymous data). We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:
| Category of Data | Examples |
|---|---|
| Identification Data | name, pronoun, national insurance number and DOB |
| Contact Data | address, email, phone number |
| Pre-Employment Data | CV’s, job application data, previous employment history, right to work information, referees and marital status |
| Observed Data | answers to job application questions |
| Special Category Data | depending on the role this could include: medical questionnaires, drug and alcohol test data, gender, ethnicity, religion, category of disability, participation in the Disability Confident employer scheme, sexual orientation and criminal offence data |
| Third Party Data | disclosure and barring service checks, referees |
| Created Data | account login, communications you send to us or receive from us |
It is your responsibility to ensure that the information you provide is truthful and accurate.
Our legal basis for processing your personal information
Whenever we process your personal data we have to have a legal basis for what we do. The legal basis are set out in data protection law. The different legal bases we rely on are:
| Legal basis | Description |
|---|---|
| Consent | You have told us you are happy for us to process your personal information for a specific purpose or purposes; |
| Legitimate interests | The processing is necessary for us to conduct our business, but not where our interests are overridden by your interests or rights |
| Contract | We must process your personal information in order to be able to fulfill contractual obligations |
| Legal obligation | We are required to process your personal information by law |
Where we process any “special category personal data”, in addition to one of the legal bases noted above, we also need to have a further legal basis for such processing. This will most commonly be one of the following:
| Legal basis | Description |
|---|---|
| Explicit Consent | where you have given us your explicit consent to the processing |
| Made public by the data subject | processing relates to personal information that you have made public |
| Legal claims and judicial acts | the processing is necessary for the establishment, exercise or defence of legal claims |
| Substantial public interest | the processing is necessary for reasons of substantial public interest (e.g. preventing or detecting unlawful acts) |
When we refer to “special category personal data” we mean personal data that reveals racial or ethnic origin, political opinions, religious beliefs, philosophical beliefs, trade union membership, genetic data, biometric data (where used for identification purposes), data concerning health, sex life or sexual orientation of an individual.
How might we process your personal information?
| Purpose of Processing | What personal data is processed? | What is our legal basis for processing this personal data? |
|---|---|---|
| To contact you about your applications | Contact Data | Legitimate interests |
| To assess you as a candidate for your applied position or other suitable positions | Identification Data, Contact Data, HR Data, Observed Data, Pre-Employment Data | Legitimate interests |
| To conduct right to work, disclosure and barring, criminal record and referee checks | Identification Data, Contact Data, Pre-Employment Data, Third Party Data | Contract, Legal Obligation |
| To set you up as an employee ahead of your start date | Identification Data, Contact Data, Financial Data, Health Data, Diversity Data, | Legitimate interests, Contract, Consent |
| To comply with our legal obligations | Identification Data, Contact Data, Financial Data, Health Data, Diversity and Special Category Data | Legal Obligation |
| To conduct statistical analysis and to help us understand more about applicants. | Pre-Employment Data, Observed Data, HR Data, Financial Data, Health Data, Diversity and Special Category Data | Legitimate interests, Substantial Public Interest |
| To report on the diversity of our candidates and to validate the fairness of our recruitment process | Identification Data, Contact Data, Financial Data, Health Data, Diversity and Special Category Data | Substantial Public Interest, Legal obligation |
Special Category Data
Special category personal data is personal data that is likely to be more sensitive and needs extra protection. It includes personal data revealing race or ethnic origin and data concerning a person’s sexual orientation. We collect this data initially so we are able to report on the diversity of our applicants and for validating the fairness of our recruitment process. You always have the choice not to provide this information and it will be held separately from your application form.
If you are successful in joining Sainsbury’s, then any special category data you provide us with during recruitment will be transferred into your colleague record but will remain segregated. You will be able to log-in on your first day, or at any time, and check this information and change any of your answers. We will use this data to ensure equality of opportunity and treatment during your employment with us and for the purposes of promoting or maintaining racial and ethnic diversity at senior levels in our business.
Cookies and similar technologies
We use cookies to help give you the best experience on our websites. For more information please see our full Cookie policy.
Who might we share your personal information with?
The Sainsbury’s Group – where appropriate we will share your personal information in certain circumstances with the other companies within the Sainsbury’s Group
Our service providers – we work with suppliers to help us recruit successfully. These third parties process your personal information on our behalf and are required to meet our standards of security before doing so. These third parties include third party vendors who help us to manage and maintain the Group IT infrastructure.
Other organisations and individuals – we may share your personal information in certain scenarios. For example:
- If we are required to by law, under any code of practice by which we are bound or where we are asked to do so by a public or regulatory authority
- If we need to do so in order to exercise or protect our legal rights, users, systems and services; or
- In response to requests from individuals (or their representatives) seeking to protect their rights or the rights of others. We will only share your personal information in response to requests which do not override your privacy interests.
International transfers of personal information
From time to time, we transfer your personal information to our Group companies, suppliers or service providers based outside of the United Kingdom for the purposes described in this privacy policy. When we do this, your personal information will continue to be subject to one or more appropriate safeguards set out in the law.
Your rights
You have a number of rights under data protection legislation which, in certain circumstances, you may be able to exercise in relation to the personal information we process about you.
These include:
- the right to access a copy of the personal information we hold about you;
- the right to correction of inaccurate personal information we hold about you;
- the right to restrict our use of your personal information;
- the right to be forgotten;
- the right of data portability; and
- the right to object to our use of your personal information.
Where we rely on consent as the legal basis on which we process your personal information, you may also withdraw that consent at any time.
If you are seeking to exercise any of these rights, please contact us using the details in the “Contact Us” section below. Please note that we will need to verify your identity before we can fulfil any of your rights under data protection law. This helps us to protect the personal information belonging to our customer against fraudulent requests. You are also able to make amends to your personal information yourself via our HR systems.
Automated decision making and profiling
We use automated decision making when you apply for a role. You will be asked a set of questions which will determine if you are likely to be invited to an interview.
You have the right to make representations about these decisions including contesting the decision and the right to obtain human intervention in any such decision.
If you are seeking to exercise this right, please contact us using the details in the “Contact Us” section below.
How long will we keep your personal information for?
We will keep your personal information for the purposes set out in this privacy policy and in accordance with the law and relevant regulations. We will never retain your personal information for longer than is necessary. If there hasn’t been activity on your candidate profile for 18 months, your data will automatically be deleted.
Security
We take protecting your personal information seriously and are continuously developing our security systems and processes. Some of the controls we have in place are:
- We limit physical access to our buildings and user access to our systems to only those that we believe are entitled to be there;
- We use technology controls for our information systems, such as firewalls, user verification, strong data encryption, and separation of roles, systems & data;
- Systems are proactively monitored through a “detect and respond” information security function;
- We utilize industry “good practice” standards to support the maintenance of a robust information security management system; and
- We enforce a “need to know” policy, for access to any data or systems.
- We will never contact our candidates requesting confirmation of account details or passwords and we advise our candidates never to enter these details into an email or after following a link from an email. If you are contacted by our recruitment team they will confirm your name and the role that you have applied for. Contact would be either by telephone, text or email using the contact numbers or email address supplied by you in your application.
Contact us
If you would like to exercise one of your rights as set out in the “Your rights” or “Automated decision making and profiling” sections above, you have a question or a complaint about this policy, or the way your personal information is processed, please contact us by one of the following means:
By email: [email protected]
By post: Data Protection Officer at Privacy Team, Sainsbury’s Supermarkets Ltd, 18th Floor, Arndale House, Manchester, M4 3AL
You also have the right to lodge a complaint with the UK regulator, the Information Commissioner. Go to ico.org.uk/concerns to find out more.
Policy change
This privacy policy was most recently updated in April 2026. If we make changes to it, then we will take steps to bring those changes to your attention where appropriate.
