Recruitment and referee privacy notice
Draft date: October 2026 · Applies to the online Employment Application Form and Employment Reference Questionnaire.
Who we are
Care Designed For You Limited, Hammerain House, Hookstone Avenue, Harrogate HG2 8ER (info@cdfy.co.uk) is the data controller for the information you give us in these forms. We are registered with the Information Commissioner's Office, registration number ZA505152 (renewal due 20 March 2027).
What we collect and why
Everything you type into the application or reference form: your answers in full, including long free-text answers, your declaration, typed electronic signature and signing date. We use it to assess suitability for employment and to meet our legal and regulatory duties for safe recruitment in adult social care.
Our lawful bases under UK GDPR: [To confirm before launch: lawful bases to be confirmed by HR/legal — likely legitimate interests and legal obligation for safe recruitment; special category data (e.g. health-related adjustment information you choose to give) likely under employment law conditions].
We do not ask about criminal convictions in these forms; any DBS check is a separate, legally reviewed process. You can ask for adjustments without giving a diagnosis. We do not use your information for marketing, we do not use analytics or advertising cookies, and we make no automated decisions about your application.
Where your information goes
- Secure online database. Your complete form is stored in a secure database provided by our website platform, Lovable (which uses Supabase for the database and Cloudflare's network for hosting). Only authorised CDFY staff with an individual administrator account and two-step verification can read it. Any adjustments you ask for are visible only to staff who need to arrange them.
- Email notification. When you submit, a short notification is emailed to CDFY's recruitment inbox (info@cdfy.co.uk), which forwards to info@caredesignedforyou.co.uk. It contains only the reference number, your name, the form type and the date — not your answers. Forms submitted before this change were emailed with their full answers. Copies remain in those mailboxes and in the email service's delivery logs; the website cannot delete them.
- Your own browser. While you fill in a form, most of your answers are saved on this device only, for up to 48 hours for the Employment Application Form and up to 24 hours for other forms, so you don't lose progress. This draft is not encrypted and is never sent anywhere. Your declaration, signature, signing date, adjustments and safeguarding-concern answers are never saved as drafts. You can clear saved answers at any time, and they are removed when you submit. Please avoid shared computers, or use the clear button when finished.
- PDF copies. Printable PDFs are created on the device of the person downloading them (you, or a CDFY administrator). They are not stored on our server, and once downloaded or emailed they cannot be recalled by the website.
- Backups and logs. The database is backed up daily and backups are kept for about 14 days, so deleted information may remain in backups until they roll off. Hosting, sign-in and email delivery logs are kept by Lovable [To confirm before launch: log retention periods to be confirmed with Lovable].
Who processes your information
Our website platform Lovable acts as our data processor for hosting, the database, staff sign-in and email delivery, and uses sub-processors including Supabase and Cloudflare. CDFY's email mailbox provider also processes the emailed copies. [To confirm before launch: Lovable's data processing agreement, full sub-processor list and processing regions to be confirmed in writing].
Because the website runs on a global edge network, some processing may take place outside the UK. Where international transfers occur, they must be protected by appropriate safeguards. [To confirm before launch: transfer safeguards to be confirmed with Lovable before launch — do not state "UK only" unless confirmed in writing].
How long we keep it
There is no automatic deletion. The earlier 365-day deletion setting has been retired. Records are reviewed and, where appropriate, deleted manually, and permanent deletion needs approval by two senior CDFY administrators. Records under a legal hold are not deleted.
Proposed policy (not yet approved): unsuccessful, withdrawn, offer-declined and not-progressed applications and their linked references would be due for review six calendar months after the recruitment decision; successful applicants' records would be reviewed 30 days after their secure transfer to a personnel file. Records without a recorded outcome, or references not matched to an application, are reviewed manually. [To confirm before launch: This proposed policy is subject to HR/legal approval].
Successful applicants' records are transferred to their personnel file. Email copies in CDFY's inboxes and any downloaded PDFs are covered by CDFY's own retention procedures, separate from this website.
If you are a referee
If you provide a reference, we process your name, job title, organisation, contact details and your opinions about the applicant for recruitment purposes. Your reference may be shared with the applicant if they ask for it, subject to data protection law.
Your rights
You can ask us to access, correct or delete your information, to restrict or object to how we use it, and to receive a copy of it. Contact info@cdfy.co.uk. You also have the right to complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113). [To confirm before launch: full rights wording to be reviewed by HR/legal].
Changes to this notice
This draft will be replaced by the approved version before the forms go live. The approved notice will be dated and any significant changes will be shown here.