This Candidate Agreement explains how Firefish Software Limited collects, uses, stores and protects your personal data when you register your interest in working for us, apply for a vacancy or otherwise participate in our recruitment process.
This agreement applies to prospective candidates and job applicants, including individuals who register their interest in future opportunities, apply directly through our website, or are identified and contacted by Firefish about a potential role.
Last updated: September 2026
1. Who we are and our obligations
Firefish Software Limited (Company Registration Number SC370891) ("Firefish", "the Company", "we", "us" or "our") takes the protection of personal data seriously.
We act as the Data Controller of personal data collected and processed for our own recruitment activities. This means that we determine the purposes for which your personal data is used and are responsible for ensuring that it is processed in accordance with applicable data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
We will ensure that your personal data is:
- Used lawfully, fairly and transparently.
- Collected for specified, explicit and legitimate purposes.
- Adequate, relevant and limited to what is necessary.
- Accurate and kept up to date where necessary.
- Retained only for as long as necessary.
- Processed securely, with appropriate protection against unauthorised access, loss or disclosure.
Our Data Protection Officer (DPO) can be contacted at dpo@firefishsoftware.com if you have any questions about this agreement, how we process your personal data, or wish to exercise your data protection rights.
2. Personal information that we collect
We collect and process personal data that is relevant to your registration, application and participation in our recruitment process.
The information we collect will depend on the role, the information you provide and the stage you reach in the recruitment process.
2.1 Personal information
This may include:
- Your name and contact details, including email address and telephone number.
- Your address or location, including postcode where provided.
- Your CV, covering letter and application information.
- Your current and previous employment details, including job titles, responsibilities and experience.
- Your qualifications, education, skills and professional memberships.
- Your employment preferences, career interests, availability and salary expectations, where provided.
- Information about the roles you have applied for or expressed an interest in.
- Your responses to application questions, interviews, assessments and other recruitment activities.
- Interview notes, assessment results, feedback and other information generated during the recruitment process.
- References and information obtained to verify details you have provided, where appropriate.
- Right to work information and relevant pre-employment check information, where required.
- Communications between you and Firefish relating to recruitment.
- Information obtained from publicly available professional sources, such as professional networking platforms or job boards, where we identify potential candidates.
- Technical information collected through our website, which may include your IP address, browser type, operating system, website activity and cookie information.
We may receive this information directly from you, through our website or recruitment systems, from recruitment agencies or other organisations, from referees where applicable, or from publicly available sources.
Please ensure that the information you provide is accurate and up to date. You should only provide information that is relevant to your application or career interests.
2.2 Special category personal data and criminal offence information
In certain circumstances, we may need to process special category personal data or information relating to criminal convictions and offences.
Special category personal data includes information about your health or disability, racial or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, genetic data, biometric data used for identification, and information concerning your sex life or sexual orientation.
Criminal offence information includes information about criminal convictions, offences and related proceedings.
We will only collect and process this information where it is necessary for a specified recruitment purpose and permitted under applicable data protection legislation. Where required, we will have an appropriate lawful basis and meet the additional legal conditions for processing this information.
This may include:
- Health or disability information where necessary to consider reasonable adjustments during recruitment or assess requirements relevant to the role.
- Information required to meet legal obligations, including applicable right to work requirements.
- Criminal conviction information where a check is lawful, relevant and appropriate for the role.
- Other special category information where a lawful condition for processing applies.
- We will take appropriate steps to protect this information and restrict access to those who need it for the relevant purpose.
You should not provide special category or criminal offence information unless it is requested or is relevant and necessary for the recruitment process.
3. How we process your personal data
We use your personal data to manage and carry out our recruitment activities, including the following purposes:
- To register and manage your interest in working for Firefish.
- To receive, process and assess applications for vacancies advertised by Firefish.
- To consider your suitability for a particular role, including reviewing your skills, qualifications, experience and employment preferences.
- To communicate with you about your registration, application, interviews, assessments and recruitment outcomes.
- To arrange and conduct interviews, assessments and other recruitment activities.
- To verify information you have provided, obtain references and undertake appropriate pre-employment checks where necessary.
- To identify and contact you about current or future vacancies that may be relevant to your skills, experience and career interests.
- To maintain our recruitment database and records of applications and recruitment decisions.
- To administer and improve our recruitment processes.
- To meet legal and regulatory obligations and establish, exercise or defend legal claims where necessary.
- To maintain the security of our website, recruitment systems and business operations.
- To communicate with you about recruitment-related matters.
Where we identify you through a publicly available professional source, job board or professional networking platform, we may use relevant information to contact you about a potential opportunity with Firefish.
We will only use your personal data for purposes that are compatible with those described in this agreement or where otherwise permitted by law.
3.1 Lawful basis for processing
We process your personal data only where we have a lawful basis under the UK GDPR.
Depending on the purpose, we may rely on:
Legitimate interest
We have a legitimate interest in recruiting suitable employees, managing applications, maintaining recruitment records and identifying candidates for current and future vacancies.
Where we rely on legitimate interests, we consider our interests alongside your rights and freedoms and ensure that our processing is necessary and proportionate.
Taking steps at your request before entering into a contract
Where you apply for a specific position, we may process your personal data where necessary to take steps at your request before entering into a potential employment contract.
Legal obligation
We may process your personal data where necessary to comply with legal or regulatory obligations, including applicable employment and right to work requirements.
The lawful basis used will depend on the specific processing activity and circumstances.
Where we process special category personal data or criminal offence information, we will also meet the additional conditions required under applicable data protection legislation.
3.2 Future employment opportunities
Where you register your interest in working for Firefish, or provide your details during an application, we may retain and use relevant information to identify you as a potential candidate for future vacancies.
This allows us to contact you where we believe your skills, experience or career interests may be relevant to an opportunity within Firefish.
We rely on legitimate interests for this activity where appropriate, taking account of your reasonable expectations, the nature of the information and your rights.
You may ask us to stop using your information for future recruitment opportunities by contacting dpo@firefishsoftware.com.
3.3 Information required for recruitment
You are not generally required to provide personal data simply because you are interested in working for Firefish. However, certain information will be necessary for us to assess a specific application or progress the recruitment process.
If you do not provide information that is necessary for us to assess your suitability or meet a legal requirement, we may be unable to progress your application or, where relevant, offer you employment.
We will only request information that is relevant and necessary for the recruitment activity concerned.
4. Third-party websites and services
Firefish may use third-party service providers to support its recruitment and business operations. These may include providers of recruitment systems, HR services, communications, IT, hosting and other business services.
Where these providers process personal data on our behalf, they are required to protect that information and process it in accordance with our instructions and applicable data protection requirements.
We may also obtain information from recruitment agencies, referees, publicly available professional sources or other organisations where relevant to your application or a potential opportunity.
We will only share personal data where necessary for the relevant purpose, permitted by law and subject to appropriate safeguards.
We do not sell your personal data or share it with third parties for their own marketing purposes.
Where personal data is transferred outside the United Kingdom or European Economic Area, we will ensure that an appropriate transfer mechanism or safeguard is in place where required by applicable data protection legislation.
5. Data retention
Firefish retains personal data only for as long as necessary for the purposes for which it was collected.
In accordance with our Privacy Policy, we generally retain personal data for two years from your most recent engagement or interaction with Firefish, unless a different retention period is necessary or permitted by law.
This includes information provided when registering an interest in working for Firefish and information collected during a recruitment process.
Where you are unsuccessful in an application, we may retain your details during the applicable retention period so that we can consider you for other suitable opportunities.
The retention period may be different where:
- We are required to retain information for a longer period to comply with a legal or regulatory obligation.
- Information is required in connection with an actual or anticipated legal claim or dispute.
- There is a legitimate and documented reason for retaining information for a different period.
- We are required to delete information following a valid request and no lawful reason for retaining it applies.
Where you are appointed, relevant recruitment information may become part of your employee record and will be retained in accordance with our employee privacy information and applicable retention requirements.
At the end of the applicable retention period, personal data will be securely deleted, anonymised or otherwise disposed of in accordance with our retention procedures.
6. Your data protection rights
Under applicable data protection legislation, you have a number of rights in relation to your personal data.
Depending on the circumstances, these include:
- Right to be informed: to understand how your personal data is collected and used.
- Right of access: to request a copy of the personal data we hold about you.
- Right to rectification: to request correction of inaccurate or incomplete information.
- Right to erasure: to request deletion of your personal data in certain circumstances.
- Right to restriction: to request that we restrict the processing of your personal data in certain circumstances.
- Right to data portability: to receive or request transfer of your personal data in certain circumstances.
- Right to object: to object to processing based on legitimate interests in certain circumstances. You have an absolute right to object to processing for direct marketing.
- Rights relating to automated decision-making and profiling: where applicable, to challenge certain decisions made solely by automated processing.
- Right to withdraw consent: where we rely on consent for a particular processing activity, you may withdraw it at any time.
These rights are subject to applicable conditions and exemptions. For example, we may need to retain certain information to comply with a legal obligation or establish, exercise or defend a legal claim.
To exercise your rights or request removal of your details from our recruitment database, please contact our DPO at dpo@firefishsoftware.com.
We may need to verify your identity before responding to a request. We will respond within the timeframes required by applicable data protection legislation.
7. Security
Firefish takes the security of your personal data seriously.
We have appropriate technical, organisational and physical measures in place to protect personal data against unauthorised access, loss, misuse, alteration or disclosure.
Access to candidate information is restricted to those who need it for recruitment or related business purposes.
Where we use third-party service providers, we take appropriate steps to ensure that your personal data is protected.
8. Cookies and website information
When you visit our website or use online recruitment facilities, we may collect technical information through cookies and similar technologies.
This may include information about your device, browser, website activity and preferences.
Our use of cookies and similar technologies is explained in our Privacy Policy, which includes information about cookie categories and how to manage your preferences.
Non-essential cookies will only be used where the appropriate consent has been obtained. Further information about how Firefish processes personal data can be found in our Privacy Policy.
9. Changes to this agreement
Firefish may update this Candidate Agreement from time to time to reflect changes in our recruitment processes, data protection practices or legal requirements.
The latest version will be made available through our website or recruitment system.
Where a significant change affects how we process your personal data, we will take appropriate steps to bring the change to your attention.
10. Complaints or queries
If you have any questions or concerns about this agreement or how Firefish processes your personal data, please contact our Data Protection Officer at dpo@firefishsoftware.com.
If you are dissatisfied with how we have handled your personal data, you have the right to raise a complaint with the Information Commissioner's Office (ICO), the UK's independent supervisory authority for data protection.
You can contact the ICO or find further information at:
https://ico.org.uk/
11. Applicant declaration
By agreeing to this Candidate Agreement, I confirm that:
- I have read and understood the information provided in this agreement about how Firefish collects, uses, stores and protects my personal data.
- I understand that Firefish will process my personal data for the purposes of managing my registration of interest, considering my application and carrying out its recruitment activities, as explained in this agreement.
- I understand that Firefish may retain and use relevant information to consider me for future employment opportunities in accordance with the purposes and retention arrangements described in this agreement.
- I understand that I can contact Firefish's Data Protection Officer if I have questions, wish to exercise my data protection rights or request removal of my details from the recruitment database.
- I understand that agreeing to this Candidate Agreement confirms that I have been provided with this information. It does not mean that Firefish relies on my consent as the lawful basis for all processing described in this agreement.
- I confirm that the information I have provided is accurate to the best of my knowledge.