Careers and Register-Interest Privacy Notice

Effective date: 3 June 2026

1. About this notice

This notice explains how Fort Hospitality Holdings Limited handles personal information submitted in connection with careers, register-interest, specialist collaboration, talent, contractor, freelance, fractional, and related capability discussions made through FHH.group.

FHH.group is the public-facing operating brand of Fort Hospitality Holdings Limited. References in this notice to "we", "us", "our", "FHH.group", or "the company" mean Fort Hospitality Holdings Limited.

Fort Hospitality Holdings Limited is the controller of the personal information described in this notice. This notice should be read together with the broader Privacy Policy, the Terms of Use, and any form-specific wording shown on the relevant page.

2. What this notice covers

This notice applies where you:

• apply for a role advertised by us;
• submit your profile through a careers, register-interest, capability, or specialist collaboration form;
• share a CV, portfolio, professional biography, LinkedIn profile, website, work sample, or similar professional material;
• contact us about employment, freelance, contractor, project-based, advisory-support, specialist, fractional, or future opportunity routes;
• take part in an interview, assessment, introductory discussion, selection process, or capability review connected with working with us; or
• are introduced to us by a recruiter, adviser, referrer, collaborator, professional contact, or other person in connection with a possible role or engagement.

If you later become an employee, worker, contractor, adviser, supplier, or other engaged person, separate contractual terms and additional privacy information may apply to that relationship.

3. Careers and register-interest routes

The company may use several routes to identify and review people with relevant skills, experience, or professional capability.

Live advertised roles

These are applications for specific roles, role families, projects, or capability needs that are open for active review.

Register-interest submissions

These are speculative or evergreen submissions from individuals who would like to be considered for future opportunities or suitable company needs.

Specialist collaboration routes

These are expressions of interest from people who may be suitable for freelance, project-based, fractional, advisory-support, or specialist collaboration work.

Direct approaches and introductions

These are details shared by or about a person through a direct approach, professional referral, recruiter, adviser, collaborator, or relevant contact.

4. Information we may collect

We may collect and use personal information that is relevant to assessing a role application, register-interest submission, collaboration opportunity, or capability discussion.

Identity and contact details

This may include name, email address, telephone number, location, country of residence, and other contact information.

Professional profile information

This may include CV, employment history, education, qualifications, certifications, skills, experience, professional biography, portfolio, website, LinkedIn profile, GitHub or similar public professional profile, and examples of work.

Application and role information

This may include role applied for, area of interest, cover note, statement of interest, answers to application questions, availability, preferred working pattern, location preferences, notice period, rate or salary expectations where voluntarily provided, and right-to-work status where relevant.

Correspondence and process records

This may include messages, emails, call notes, interview notes, assessment observations, internal review comments, scheduling records, and records of decisions or next steps.

Attachments and supporting materials

This may include CVs, portfolios, documents, presentations, links, files, work samples, or other supporting materials submitted through a website form or by email.

Verification information at later stages

This may include references, identity checks, right-to-work information, qualification checks, or other verification material where relevant, lawful, and proportionate.

Technical and form-handling information

This may include technical or interaction information generated through reCAPTCHA or similar anti-spam/security tools where those tools are used to protect careers, role application, register-interest, or file-upload routes from spam, automated misuse, or abuse.

This may include basic technical information connected with the submission, such as time of submission, form route, security signals, spam-prevention information, attachment metadata, and related website or communications records.

We aim to collect only information that is reasonably relevant to the role, capability, opportunity, or collaboration context.

5. Information you should not submit

Please do not include information that is not reasonably necessary for the relevant application, register-interest submission, or capability discussion.

In particular, please avoid submitting:

• full confidential briefs, proprietary materials, or trade secrets belonging to a current or former employer, client, or third party;
• personal information about other people unless you have a proper basis for sharing it;
• health, disability, ethnicity, religion, political opinion, trade union membership, sexual orientation, biometric, genetic, or similar special category information unless it is specifically requested or clearly relevant to an adjustment, legal obligation, or process requirement;
• criminal offence information unless specifically requested and legally relevant;
• copies of passports, visas, identity documents, bank details, national insurance numbers, or similar documents at the initial public form stage unless specifically requested through an appropriate process; and
• large, unsafe, irrelevant, encrypted, password-protected, or excessive attachments.

Initial careers and register-interest forms are designed for first contact and appropriate review. Please submit concise, relevant professional information only. More detailed documents may be requested later if a process moves forward.

6. How we use careers and register-interest information

We may use careers and register-interest information to:

• review suitability for a live role, future role, capability need, specialist collaboration, or project-based opportunity;
• assess whether a person's experience, skills, availability, and professional profile align with the company's areas of work and operating needs;
• contact relevant individuals about an application, role, discussion, interview, assessment, collaboration opportunity, or next step;
• manage application processes, scheduling, interviews, assessments, internal reviews, decision-making, correspondence, and related administration;
• maintain a limited record of individuals whose profiles may be relevant to future company needs;
• verify information at later stages where relevant, lawful, and proportionate, including references, right-to-work information, qualifications, or similar checks;
• manage legal, regulatory, accounting, insurance, audit, or record-keeping obligations where applicable;
• protect the company's legal position, prevent misuse, maintain security, and deal with complaints, disputes, or enquiries where necessary and proportionate; and
• review and improve careers, register-interest, and capability intake processes.

Submitting a profile, application, register-interest form, CV, portfolio, or other material does not guarantee a response, interview, assessment, offer, engagement, employment relationship, or future opportunity.

7. Lawful bases for processing

We rely on different lawful bases depending on the context and the type of information involved.

Reviewing applications for live roles

The typical lawful basis is legitimate interests in assessing suitability and managing recruitment. In some cases, processing may also be based on steps taken at the individual's request before entering into a contract.

Register-interest and speculative profile submissions

The typical lawful basis is legitimate interests in reviewing relevant capability and maintaining a limited talent or specialist-interest record. Consent may be used where a specific consent request is presented.

Communicating about roles, interviews, assessments, or next steps

The typical lawful basis is legitimate interests in managing genuine applications, submissions, and company communications.

Freelance, contractor, specialist, or fractional opportunity discussions

The typical lawful basis is legitimate interests in assessing potential collaboration and, where relevant, steps taken before entering into a contract.

Right-to-work, identity, eligibility, or legally required checks

The typical lawful basis is compliance with legal obligations and legitimate interests in verifying suitability and protecting the company.

References, qualification checks, or professional verification

The typical lawful basis is legitimate interests in verifying information and assessing suitability, where lawful and proportionate.

Reasonable adjustments or accessibility-related information

The typical lawful basis may include compliance with legal obligations, legitimate interests, and, where needed, an appropriate condition for special category data under applicable law.

Equality monitoring, if introduced

Equality monitoring would be handled separately and, where used, on an appropriate lawful basis with clear information at the point of collection.

Legal claims, complaints, disputes, or record protection

The typical lawful basis is legitimate interests and, where necessary, the establishment, exercise, or defence of legal claims.

Where we rely on consent for a specific activity, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. In many recruitment and capability-review contexts, however, we rely on legitimate interests, steps before contract, or legal obligations rather than consent.

8. Special category and sensitive information

We do not seek special category personal data through public careers or register-interest forms unless there is a clear reason and an appropriate lawful basis for doing so.

Special category information can include information about health, disability, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for identification, sex life, or sexual orientation.

If you need a reasonable adjustment or accessibility support in connection with a recruitment or selection process, you may provide the information reasonably necessary for us to consider and respond to that request.

If equality monitoring is introduced, it should be optional, clearly explained at the point of collection, and handled separately from suitability assessment where appropriate.

We do not ask for criminal offence information through public forms unless it is specifically required, lawful, proportionate, and supported by an appropriate process.

9. Attachments, portfolios, and supporting materials

Where a careers or register-interest form permits attachments or links, please provide only materials that are reasonably necessary for the relevant application or capability review.

Attachments may include a CV, portfolio, professional biography, work sample, presentation, or other relevant material. Please do not submit material that is confidential to a current or former employer, client, collaborator, or third party unless you are entitled to share it.

We may decide not to open, review, retain, or respond to attachments that appear unsafe, excessive, irrelevant, unlawful, confidential without an agreed basis, infected, encrypted, password-protected, or inconsistent with the intended purpose of the form.

Where practical, the website may restrict permitted file types, file sizes, and upload formats. Those technical restrictions are intended to support security, review quality, and proportionate handling.

10. How the process works

Careers and register-interest submissions are reviewed selectively and in line with actual company needs, timing, capability fit, available roles, and collaboration requirements.

A process may include some or all of the following stages:

• initial review of the submitted form, CV, portfolio, links, or supporting material;
• internal assessment of relevance, timing, capability fit, and current or future business need;
• follow-up correspondence, introductory discussion, interview, assessment, task, or portfolio review where appropriate;
• request for additional information reasonably necessary to progress a role, collaboration, or engagement discussion;
• reference, right-to-work, qualification, identity, or other checks at a later stage where relevant, lawful, and proportionate; and
• written offer, engagement terms, contract, or other formal documentation where a role or engagement proceeds.

Submitting a profile, application, or register-interest form does not create an employment relationship, contractor relationship, advisory relationship, or obligation to respond. Where a role, engagement, or collaboration proceeds, it will be subject to separate written terms and any checks or requirements that apply to that relationship.

11. Live roles and future opportunities

Where a live role is advertised, information submitted for that role will be used primarily to assess that specific opportunity and manage the related process.

Where you submit a speculative or register-interest profile, information may be reviewed against future roles, capability needs, or specialist collaboration opportunities for a limited period.

If we wish to consider your information for a materially different role, opportunity, or purpose, we may contact you where appropriate to confirm interest or request updated information.

You may ask us to delete or update a speculative profile or register-interest submission at any time, subject to any legal or legitimate reason requiring retention of limited information.

12. Right-to-work, references, and other checks

Right-to-work checks, identity checks, references, qualification checks, or similar verification steps are not normally required at the initial public form stage.

If a process moves forward, we may request additional information that is reasonably necessary to verify eligibility, suitability, qualifications, experience, or the ability to enter into an employment, contractor, freelance, or other engagement arrangement.

Where right-to-work checks are required, they will be handled in line with applicable UK requirements and any relevant official guidance in force at the time.

We will usually seek references or contact referees only at an appropriate stage of the process and, where appropriate, after informing you or obtaining the necessary details from you.

13. Automated decision-making

We do not use public careers or register-interest submissions to make solely automated decisions that produce legal or similarly significant effects on individuals.

Technology may be used to receive, route, organise, filter for security, store, or manage submissions. Final recruitment, suitability, or engagement decisions are not made solely by automated processing.

If this position changes in a material way, we will update this notice and provide appropriate information where required.

14. Who we share information with

We do not sell applicant, candidate, or register-interest information.

Relevant information may be shared where necessary and proportionate with:

• people within the company who need the information for recruitment, capability review, collaboration assessment, administration, or decision-making;
• service providers that support website forms, file uploads, business email, hosting, cloud storage, productivity tools, scheduling, security, spam prevention, analytics, or related administration;
• external recruiters, advisers, consultants, or specialists where they support a specific process and where sharing is lawful and appropriate;
• referees, qualification bodies, right-to-work or identity-check providers, or verification services where relevant at a later stage;
• professional advisers such as lawyers, accountants, auditors, insurers, or compliance advisers;
• courts, regulators, law-enforcement bodies, public authorities, or other third parties where disclosure is required by law or reasonably necessary to protect legal rights; and
• successor or transaction-related parties where relevant information is handled as part of a lawful business reorganisation, transfer, sale, investment, restructuring, or similar corporate process.

Where third-party service providers process information on our behalf, we expect them to handle it under appropriate contractual, confidentiality, security, and data-protection arrangements.

15. International transfers

Some services used to support website forms, communications, hosting, file handling, storage, scheduling, security, or administration may involve processing outside the United Kingdom.

Where personal information is transferred internationally, we take reasonable steps to ensure that it remains protected in a manner consistent with applicable data protection law. Depending on the circumstances, those steps may include reliance on adequacy regulations, standard contractual clauses, the UK International Data Transfer Agreement or Addendum, contractual protections, supplier due diligence, and other appropriate safeguards.

The exact providers used by the website and related business systems may change over time. The broader Privacy Policy provides additional information about provider categories and international transfers.

16. Retention

We keep careers and register-interest information only for as long as it is reasonably necessary for the purpose for which it was collected, including to review suitability, manage a process, maintain appropriate records, comply with legal obligations, resolve disputes, and protect legal position.

Live role applications that do not proceed

These are typically retained for up to 12 months from the final decision or last meaningful contact, unless a longer period is justified by law, dispute, audit, or business need.

Register-interest or speculative profile submissions

These are typically retained for up to 12 months from the last meaningful contact or most recent profile update, unless earlier deletion is requested or a longer period is justified.

Interview notes, assessment records, and process correspondence

These are typically retained for up to 12 months after the relevant process ends, unless a longer period is needed for legal, dispute, audit, or record-keeping reasons.

Right-to-work, identity, eligibility, reference, or verification records

These are retained where relevant in line with the legal, employment, contractor, or engagement requirements that apply to the relationship or proposed relationship.

Information relating to an appointed employee, contractor, adviser, or supplier

This is handled under the separate terms, policies, and retention periods that apply to that relationship.

Security, spam-prevention, and technical form records

These are typically retained for a limited period in line with operational, security, and legal need, as described further in the Privacy Policy.

Actual retention periods may vary where the circumstances require a longer or shorter period. We review retention periodically and aim not to keep personal information longer than necessary.

17. Security and handling

We take reasonable technical and organisational measures to protect careers and register-interest information against unauthorised access, unlawful processing, misuse, accidental loss, destruction, or disclosure.

These measures may include access controls, secure service providers, controlled administrative access, file-handling restrictions, encryption in transit where appropriate, malware and spam controls, and internal procedures for reviewing and storing submissions.

No website, form, email system, upload route, or digital service is completely risk free. Please consider this before submitting sensitive or unnecessary information.

18. Your rights

Subject to applicable law, you may have the right to:

• request access to the personal information we hold about you;
• ask that inaccurate or incomplete information is corrected;
• request deletion in certain circumstances;
• ask that our use of your information is restricted in certain circumstances;
• object to particular processing in certain circumstances;
• where applicable, request portability of information you provided to us; and
• withdraw consent where we rely on consent for a specific activity.

You also have the right to lodge a complaint with the Information Commissioner's Office in the United Kingdom if you believe your personal information has been handled unlawfully or unfairly. Information about the ICO is available at www.ico.org.uk. We would welcome the opportunity to address concerns directly first.

Where necessary and proportionate, we may ask for information to verify identity before responding to a request about personal information.

19. Data protection complaints

We would welcome the opportunity to address privacy questions, rights requests, and data protection complaints about careers, role application, register-interest, or specialist collaboration information directly first. Please contact hello@fhh.group if you have a question or concern about how this information has been handled.

If you make a data protection complaint, please provide enough information for us to understand the issue, the relevant role or submission route, the information involved where known, and the outcome you are seeking. Please do not include unnecessary sensitive information when raising a complaint.

We aim to acknowledge receipt of data protection complaints within 30 days and to take appropriate steps to consider and respond to them without undue delay. Where a matter requires further review, we may ask for additional information, verify identity where necessary, and keep you informed as appropriate.

Where we complete our review of a data protection complaint, we will tell you the outcome without undue delay. This does not affect any rights you may have under applicable data protection law or your right to lodge a complaint with the Information Commissioner's Office.

20. Updating, withdrawing, or deleting a submission

You may contact us to update a CV, profile, application, register-interest submission, or related information.

You may also ask us to withdraw an application or delete a speculative or register-interest submission. We will consider and respond to such requests in line with applicable law and any overriding legal, operational, dispute-management, or record-keeping reason requiring limited retention.

If you ask us to delete a submission, this may mean we are no longer able to consider you for the role, opportunity, or future capability need connected with that information.

21. Children and young people

The careers and register-interest routes on FHH.group are not directed to children.

Please do not submit information through a careers or register-interest route unless you are legally able to do so and, where relevant, legally able to work or engage in the type of opportunity being discussed. If information relating to a child or young person is submitted without appropriate authority, please contact us so that we can review the position.

22. Changes to this notice

We may update this notice from time to time to reflect changes in the website, roles, recruitment routes, register-interest processes, service providers, legal obligations, or the way careers and capability information is handled.

When material changes are made, the effective date at the top of this notice will be updated and, where appropriate, additional steps may be taken to draw the changes to users' attention.

23. Contact

If you have questions about this notice or about the way careers and register-interest information is handled, please contact hello@fhh.group.

Postal correspondence may be sent to Fort Hospitality Holdings Limited, 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.

For broader information about how Fort Hospitality Holdings Limited handles personal information, please read the Privacy Policy.