Our privacy notice for candidates

Making it clear how we handle your information

Click on the links below to jump to the sections you want to find out more about.

Quickly find what you are looking for

1. About our privacy notice

This notice applies to anyone applying for a role at StepChange. It does not apply to contractors or trustees. This notice tells you, as a StepChange candidate:

What personal data we hold about you
How and why we use that personal data
What your legal rights are and how to apply them

We recommend that you read this notice before applying for a role at StepChange.

'Personal data' means any information that:

Is about you
Which can be used to identify you

In some cases this personal data could be more sensitive. It may be personal data that is private to you.

As your potential employer we will need to collect and use your personal data. We need to do this to make sure we are carrying out all our responsibilities.

We will also use your personal data to:

Review and progress your application
Arrange any required interviews, meetings or assessments etc
Find out how we can support you through the recruitment process
Carry out any checks we must make by law

A full list of how we use personal data has been included at Section 4 of this notice.

If you are already a StepChange colleague, you may wish to read our Colleague Privacy Notice.

2. Who is responsible for your personal data?

StepChange is the trading name of the following company:

The Foundation for Credit Counselling

Trading as StepChange Debt Charity and StepChange Debt Charity Scotland

Registered Office:

123 Albion Street
Leeds
LS2 8ER

Registered In England no. 2757055
Registered charity in England and Wales: 1016630, Scotland: SC046263.
Authorised and regulated by the Financial Conduct Authority.
ICO registration No. Z743192X

This company is known as the 'Data Controller'. This means we are responsible for deciding:

Why we collect personal data about you
What personal data we collect
How we use your personal data
How we store your personal data

Colleagues only have access to the personal data they need to do their job. We have controls in place to ensure this.

Our Data Protection Officer checks we are meeting the law and standards across the Group. Their contact details have been included in Section 12.

3. Where do we collect your personal data from?

In most cases, we will collect your personal data directly from you. This could be your personal details, CV, application form details and contact information, which we will collect from you when you apply for a role with us.

We may also sometimes get personal data from other sources. These include:

Recruitment agencies, if we have used them as part of the recruitment process
Law enforcement agencies, regulators and government departments (only in certain circumstances)
Others who are acting on your behalf, such as recruiters, agents or your representatives
People you have a personal relationship with
From technology you use to access our systems. For example, your IP address
LinkedIn
Third party job boards and CV Databases
Your referees (such as previous employers), where you have provided these details to us

4. What personal data do we collect about you and why?

The types of personal data we collect about you will depend on the progress of your application. This could include:

General data	Such as: Your identifiers, biographical information, and employment history (including whether you are or ever have been a StepChange employee)	So that we know how to address you and can review your application
Communications data	Such as: Contact details	So that we can contact you when possible, including in the event of an emergency
Employment history & experience	Such as: your previous employers and the roles you have held with them	So that we can review your application and contact your previous employer (where a reference is needed)
Financial data	Such as: your bank account information and details of any payments made	To reimburse you for any expenses (where this has been agreed in advance)
Sensitive data	Such as: your health, additional needs, and diversity information (where you have provided this to us).	To offer any support or accommodations you need throughout the recruitment process
Data shared about crime	Such as: any disclosures you make to us or any information we receive as part of right to work and/or vetting processes	So that we can consider this as part of your application
Other data	Such as: any other information you provide to us while you progress through our application process	We gather this data because we have a legitimate interest to carry out recruitment activities. In some cases we may have a legal obligation to gather this data, such as to carry out pre-employment checks.

Where you have provided sensitive information about yourself, we will only use this data to ensure that we are providing equality of opportunity and treatment.

If you do not provide the personal data we ask for, we may not be able to continue with your application. For example, we need personal data about you to:

Consider your application and CV
Invite you to interviews and assessment centres
Conduct interviews with you
Carry out pre-employment checks required by law
Make any reasonable adjustments required

By law, there are some times when we may have to use or share your personal data without telling you first. For example, to investigate a crime or if we receive a court order.

5. When do we use Automated Decision Making?

StepChange does not use any Automated Decision Making as part of our recruitment process.

Data controllers

There are a number of reasons why we might share your personal data with other organisations. We sometimes may need to do this where:

Where we have a legitimate business reason
Where we have to by law
To meet the terms of a contract
Where you have told us we can do this

Who we may share personal data with and why:

Government departments and agencies: Where we must share personal data by law. Such as HM Revenue and Customs (HMRC), HM Treasury, and the Department of Work and Pensions (DWP)
Online identity checking services, to complete mandatory pre-employment checks
Your former employers, if we need to request a reference
Regulators: Where we must share personal data by law. These include the Charity Commission, the Financial Conduct Authority (FCA), Insolvency Practitioners Association (IPA), and the Information Commissioner's Office (ICO)
Law enforcement agencies: Where we need to report a crime. Also to help them detect, investigate and prevent crime
Legal professionals, Courts of Law and other parties: Where information is needed for legal claims and proceedings
Auditors: Where we have to be audited by law, or through our charity governance framework
Our insurers
Our accountants, legal, and compliance advisers. As well as other specialist consultants or contractors

We may also share your personal data if you have asked us to or told us we can.

We will keep records of what has been shared with third parties and why.

Our suppliers

We also work with third party suppliers who help to carry out our duties as an employer.

Our suppliers will only have access to your personal data where we have given them strict instructions and have first made sure that your personal data is secure when it is with them.

We use them for:

To set up your employment benefits package. For example, our pension or occupational health providers
Outsourced administration services
IT services, software and hardware
Provision of recruitment software to make, receive, review and track applications

There may be other examples.

Sharing statistics

We may share 'statistical data':

Internally within our organisation
With Charity partners and funders
The wider public

In these cases, you will not be able to be identified.

7. Do we complete pre-employment checks?

As part of our recruitment process, we may carry out pre-employment checks to establish your suitability for the role you have applied for. Depending on the role, this may include the Disclosure and Barring Service (DBS), CIFAS or our regulators. For example, this may happen if your role is covered by the Financial Conduct Authority’s Senior Manager and Certification Regime.

As part of these checks, we may share basic personal identifiers with these companies to enable them to identify you, such as your name and date of birth. Depending on the company, the responses we receive may include:

Details of criminal convictions
Details of convictions for fraud or identity fraud
Any information that suggests your identity is at risk of impersonation
Any information that previous employers have reported to the FCA or other regulators

The outcome of these checks may affect your employment with StepChange, as they may mean that you are not a suitable candidate for the role you have applied for.

StepChange does not use Credit Reference Agencies as part of our recruitment process. If you are employed by StepChange via a recruitment agency, the agency may carry out their own Credit Reference checks. To learn more about this please read the agency's privacy notice.

8. How long will we keep your personal data for?

We will need to keep your personal data to:

Progress your application
Prepare for you joining us, if you are successful. Such as setting up user accounts and processing your pay and benefits

If you are successful in your application: We will keep your personal data for six years following the end of your employment with us.

If you are not successful: We will keep your application data for twelve months after the end of your application process. Any interview notes will be kept for six months.

In some cases we may need to keep some information for longer. This could be if there is the need to comply with laws and standards or for defending legal claims.

What about recording of phone calls and other interactions?

StepChange does not record any phone calls between us and our applicants. In some exceptional cases video calls will be recorded, where this has been agreed prior to the meeting.

9. How do we keep your personal data secure?

We take appropriate technical and organisational measures to make sure that the data we hold is safe and secure.

We only allow your personal data to be used by individuals who need it to carry out their job and all of our employees and contractors are subject to confidentiality rules.

We regularly review our security controls and monitor for security breaches. We have processes in place to handle security breaches if they do happen.

10. Will we transfer any of your personal data outside of the UK?

We may need to do this from time to time. For example, if a supplier has computer servers in another country.

But we will only do this if:

That country meets data protection standards, as laid out by UK law. Such as, countries in the European Economic Area. Or,
We, or one of our third partythird-party data processors, have entered into a contract with an organisation outside of the UK, on terms approved by the UK's data protection regulator. We also have assessed that country's laws. Or,
You have clearly asked us to share your personal data with an organisation outside of the UK and we have explained the risks of doing so to you

11. What are your data protection rights?

You have a number of rights relating to how we use your personal data.

Please contact us at DPO@stepchange.org to make a request.

We may need you to share extra detail so we can check who you are and understand what you need from us.

In most cases, we will respond within one calendar month. If there is a reason that this is taking us longer than that, we will let you know.

Your rights are:

To have access to, or a copy of, this privacy notice
To get copies of the information we hold about you
To get confirmation of how we use and/or have used your personal data
To find out how long we will continue to store your personal data
To update any information that is wrong, incomplete, or out of date
To delete or destroy data we hold about you if we no longer need it
To restrict the use of your personal data
To ask us to transfer your personal data to another organisation
To object to how we use your personal data
To take away any consent you have given us before
To ask for a human review where a decision has been made using a computer

There can be exemptions or restrictions for all of the above rights. If so, that could mean that we would not be able to do as you have asked. We will let you know if this is the case.

12. How can you complain about how we use your personal data?

If you are unhappy with how we have used or handled your personal data, or if you are unhappy with how a data protection request was handled, please email DPO@stepchange.org with details.

You may also raise any concerns with the Information Commissioner's Office. They are the UK's Data Protection regulator. Visit their website (www.ico.org.uk) to find out more about how to contact the ICO or call 0303 123 1113. Please note that the ICO expect you to have gone through our internal complaints process before raising a complaint with them.

13. Will we tell you about any changes in how your personal data is used?

We reserve the right to update this privacy notice at any time.

We may write to you to let you know if major changes are made to this notice.

We may also tell you in other ways, from time to time, about how we use your personal data.

We will only use your personal data for the reasons why we collected it, unless:

We reasonably think we need to use it for another purpose, and
That reason is compatible with the original purpose

If we need to use your personal data for a new reason, we will let you know and we will explain why we are allowed to do this by law.

This notice does not form part of any contract with you. We may update this notice at any time.

Published: December 2025. (Version 1).