Privacy Notice for Applicants
Data Controller
United Kingdom Head Office
WH Smith PLC (Company number 05202036)
Address: Windmill Hill Business Park, Whitehill Way, Swindon, Wiltshire, England, SN5 6PB
Data Protection Officer: data.privacy@whsmith.co.uk
WH Smith Germany GMBH
Address: Flughafen Koln/Bonn CmbH Buro Nr. TIM-405. Terminal 1, Bauteil Mitte, 4. OG, Heinrich-Steinmann-Strase 12, 51147 Koln
WH Smith Ireland Limited and Newsrail Resources Limited – Ireland
Address: Floor 6, 2 Grand Canal Square, Dublin 2, Ireland
WH Smith Travel SAS – France
Address: 248, Rue de Rivoli, 75001 Paris
WH Smith Singapore PTE Limited
Address: 11 Keng Cheow Street, #03-10, The Riverside Piazza, Singapore 059608
Data Collection
As part of the recruitment process, we collect and process personal data relating to job applicants. We are committed to being transparent about how we collect and use your data.
How we collect personal data
We collect personal data about you from various sources including:
From CV databases such as Indeed, GlobalFlex, GoogleJobs, AppCast, and social media sites such as LinkedIn when we are searching for suitable applicants for vacancies
Personal data we collect
We collect a range of information about you, including:
With your consent, special category data for equal opportunities monitoring including ethnic origin, sexual orientation, health, and religion or belief
We are required to meet additional security and legal obligations when we collect information about your health, racial or ethnic origin, religious or philosophical beliefs or political opinions, sexual orientation, and trade union membership. There are also additional restrictions on the circumstances in which we are permitted to collect and use criminal convictions data.
Legal Basis for Processing
In most instances our legal basis for processing your data is to take steps when you have applied for a position prior to entering into a contract of employment with you. In some cases, we need to process data to ensure we comply with legal obligations as an employer including to confirm that a successful applicant is eligible to work in the relevant country. Processing data from job applicants allows the Company to manage the recruitment process, assess and confirm a candidate's suitability for employment, and decide to whom to offer a job. We may also need to process data from job applicants to respond to and defend against legal claims.
Please refer to Appendix I for a detailed list of our legal bases for processing.
In relation to special category data and data regarding criminal convictions and offences, we need additional safeguards and justification for processing personal data. These are set out in Appendix I.
For the processing of special category data (e.g. health information) our legal basis is explicit consent, legal obligations under employment law (e.g. to process information relating to any medical condition or disability to make reasonable adjustments for the recruitment process), and to comply with additional local legal requirements.
For positions where increased security is required (e.g. positions at airports and rail stores), we are legally and contractually required to perform criminal convictions record checks as part of the recruitment process, or we may be notified of such information directly by you while you are working for us.
How we use your personal data
We use your personal data for the following purposes:
Automated decision-making
The TeamTailor recruitment platform has been configured to perform an initial assessment of your suitability for a role based on salary expectations and eligibility to work. If these criteria are not met, the application will not progress.
Some of our positions require the use of automated decision-making through applicant competency-based assessments. All applications are measured against a required competency level (which will be outlined to you during the application process/in the specification for the role). Applications which do not meet this required level will be automatically withdrawn from the short-listing process. You have the right to request a review of an automated competency decision.
If you do not provide the personal data
We need some of your personal data to conduct the recruitment and selection process. If you do not provide such personal data, we may not be able to continue with the recruitment process or offer you employment/engagement. We will explain if this is the case when we request personal data from you.
How we share personal data
We share your personal data in the following ways:
Where we use third party service providers who process personal data on our behalf such as recruitment agents, recruitment platforms, local police services, agencies for criminal conviction checks, airport security vetting, airport management entities, and IT systems providers.
When an offer of employment is made, we may share your information with service providers who perform pre-employment background checks (e.g. at airports, performed by ClickID https://www.click-id.co.uk/), medical service providers when required by law to conduct medical fitness assessments (e.g. Attentia, Health and Safety, Ministry of Mangpower, Arboned, Swiss Medical Service, company employed doctor, GP’s, etc). Please refer to the privacy notices of the applicable airport locations.
Where we share your personal data with third parties, we ensure that we have appropriate measures in place to safeguard your personal data and to ensure this is shared lawfully with these entities.
International Data Transfers
Where data is transferred outside of the UK or European Economic Area (EEA) we ensure that transfer safeguards such as the EU Standard Contractual Clauses and the UK International Data Transfer Addendum (the Addendum) or the International Data Transfer Agreement (IDTA) are included in contractual agreements with processors and partners.
We have put in place appropriate technical and organisational measures to safeguard your data and ensure that our service providers and partners meet our expectations in respect of the safety of your data. We screen all service providers to ensure they are compliant with our security and data management standards.
If your application for employment is unsuccessful, we will hold your data on file for 6 months after the end of the relevant recruitment process unless you consent to remain on our talent pool list for a longer period. During this period, we may also contact you for consideration for future employment opportunities if you have agreed to the retention of your data for this purpose. At the end of that period, or once you withdraw your consent (whichever is sooner), your data will be deleted.
If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your personnel file and retained during your employment. The periods for which your data will be held will be provided to you in our Colleague Privacy Notice.
Your Data Rights
You have a number of rights in relation to your personal data:
To request that we erase your personal data, known as the Right To be Forgotten. If we are required to retain this data for longer periods to meet our legal obligations, we will inform you of the period and the reason for retaining the data.
If you are not satisfied with the response you receive, you have the right to complain to the regulator in the relevant country
Information Commissioner's Office
Office of the Information Commissioner (OIC)
6 Earlsfort Terrace, Dublin 2, D02 W773
Data Protection Officer details
You can contact the Data Protection Officer using the following details:
Group Data Protection Officer
Address: WHSmith PLC, Aldgate Towers, 2 Leman Street, London, E1 8FA
Last Updated: 09/ 07/ 2026
Appendix I: Legal Basis for Processing
Name, addresses, telephone numbers, personal email addresses, date of birth
Administration of employment application and contract; business communications
Article 6(1)(b) - Performance of contract
Article 6(1)(c) - Legal obligation
Emergency contact information
Next of kin and emergency contact details
Health and safety; emergency situations
Article 6(1)(d) - Vital interests of data subject
Article 6(1)(f) - Legitimate interests (employee welfare)
Employment history and records
Start date, location of employment, job titles, work history, working hours, training records, professional memberships
Contract administration; workforce planning; compliance with Working Time Regulations
Article 6(1)(b) - Performance of contract
Article 6(1)(c) - Legal obligation
Right to work documentation, references, selection materials (interview notes, test results), CV, cover letter, application information
Recruitment and selection; right to work verification; employment decision
Article 6(1)(b) - Steps prior to entering contract
Article 6(1)(c) - Legal obligation (right to work checks)
Article 6(1)(f) - Legitimate interests (evidencing fair recruitment)
Aggregated/anonymised applicant data
Applicant analytics; understanding retention and attrition rates; business planning
Recruitment offers (seasonal/location)
Contact details, employment history, location data
Informing seasonal workers of temporary employment opportunities at different locations
Article 6(1)(f) - Legitimate interests (ensuring stores are well-staffed, particularly at peak periods)
Article 6(1)(a) - Consent (for applicants wishing to remain on pool list for future opportunities)
Medical condition, health records
Health and safety compliance; reasonable adjustments under Equality Act 2010;
Article 6(1)(c) - Legal obligation
Article 9(2)(b) - Employment, social security and social protection law
Article 9(2)(h) - Health or social care (occupational health)
Race, ethnic origin, religious beliefs, sexual orientation
Equal opportunities monitoring and reporting
Article 6(1)(c) - Legal obligation (Equality Act 2010 duties)
Article 6(1)(a) - Consent (voluntary diversity profile updates)
Article 9(2)(g) - Substantial public interest
Article 9(2)(a) – Explicit consent
Trade union membership information
Paying trade union premiums; registering protected employee status; complying with employment law obligations
Article 6(1)(c) - Legal obligation
Article 6(1)(b) - Performance of contract
Article 9(2)(b) - Employment, social security and social protection law
Criminal convictions data
Retail industry-specific criminal record checks
Assessing suitability for employment in roles involving access to retail goods, cash handling, or positions of trust
Article 6(1)(c) - Legal obligation (where role-specific requirement)
Credit reference checks, financial probity data
Assessing suitability for roles involving financial responsibility or access to financial systems
Article 6(1)(f) - Legitimate interests (protecting business from fraud, ensuring financial probity in relevant roles)
DBS checks / background checks revealing criminal data
DBS certificates, background check reports containing criminal conviction data
Pre-employment screening for roles meeting DBS eligibility criteria or sector-specific requirements
Article 6(1)(c) - Legal obligation (where DBS check legally required)
N/A (unless security clearance reveals special category data)