Privacy Policy

Privacy Notice – Recruitment

This Privacy Notice explains what happens to the personal information that we collect from you whenever you contact our recruitment team, create an applicant profile, apply for a job,  or set up job alerts via our career hub. This Privacy Notice applies to candidates only – if you are recruited, we will provide you with a separate employee privacy notice.

We may update this Privacy Notice from time to time so please check with us occasionally to ensure that you’re happy with any changes. This Privacy Notice was last updated on 10 August 2026.

Please take time to read this Privacy Notice carefully so you understand how we treat and use your personal information.

Who are we?

We are Greggs plc, one of the UK’s leading food-on-the-go retailers ("we" or "us").  Greggs plc is registered at Companies House under company number 00502851 and our registered office is at Greggs House, Quorum Business Park, Newcastle upon Tyne, NE12 8BU. We are the data controller of your personal information.

We are also registered with the Information Commissioner’s Office under registration number Z7225689.

If you have a question regarding how we use your personal information, please address your communication to the "Data Protection Analyst" using one of the methods set out in the “How can you find out about and update your information?” section of this Privacy Notice.

We take data protection very seriously and respect the privacy of our applicants. We are committed to protecting and respecting your privacy, in accordance with the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.

What information do we collect from you?

We may collect, store and use any of the following personal information from you:

  • Your full name;
  • Your contact telephone number;
  • Your email address;
  • Your home address;
  • Your education history;
  • Details of your work history; and
  • Any additional personal information which you may choose to provide when completing your application, sharing your CV, corresponding with us or otherwise interacting with our recruitment team.

We may also collect, store and use the following ‘special categories’ of personal information:

  • Equality and diversity information (including details of your ethnicity, gender, any disabilities and, where you are located in Northern Ireland, details of your community background).

We may also collect, store and use criminal offence information about you, including information about unspent criminal convictions and offences. Criminal data is not included within the definition of special categories of personal information but we will process criminal data using the same safeguards we operate in respect of special categories of data.

Before we are able to make any job offer, we will also collect from you:

  • Proof of your right to work in the United Kingdom (for example a copy of your passport, birth certificate or working visa);
  • Documentation for role specific requirements (for example a copy of your driving licence or professional qualifications); and
  • Any other documentation required to enable you to fulfil your role (for example Disclosure and Barring Service (DBS) checks).

We will also take notes during the course of your interview which will form part of your recruitment record.

How is your personal information collected and held?

We usually collect personal information directly from you when you enquire and/or apply for a role with us. We may also collect personal information about you from a recruitment agency, former employer, named referees and background check agencies.

Once collected via the career hub or a tablet for interviewing purposes, we will hold your personal information on our “Tribepad” recruitment system, which is held on the secure systems of our third party supplier based in the Netherlands.

When you contact our recruitment team via email and telephone, we will hold your personal information within our customer contact management system. We record calls and create transcripts of those calls for training, quality assurance, recruitment administration and record-keeping purposes.

How will we use your information?

UK GDPR says that we are allowed to use personal information only if we have a proper reason to do so which may be:

  • To fulfil a contract we have with you; or
  • When it is our legal duty; or
  • When it is in our legitimate interests; or
  • When you consent to it.

A legitimate interest is when we have a business or commercial reason to use your information. But even then, it must not unfairly go against what is right and best for you. If we rely on our legitimate interests, we will tell you what that is.

We may use your personal information for the reasons and in accordance with the legal basis below:

Purpose of Processing

Your Personal Information

Legal Basis

 

To assess your suitability for the job that you have applied for.

Necessary for our legitimate interests to ensure that suitable candidates are selected for interview and employment.

To check your eligibility to legally work in the United Kingdom.

We have a legal duty.

To contact you to arrange interviews, assessment days and to notify you about the outcome of your application.

Necessary for our legitimate interests to ensure that applicants are kept informed of the progress of their applications.

To send you job alerts via email or SMS.

On the basis of consent, specifically where you have opted to receive job alerts via your preferences in the “Job Alerts” section of your online profile page.

Where we need to provide your contact details to third parties to undertake checks (for example DBS checks or right to work checks with the Home Office). 

This is both on the basis that:

  • We have a legal duty.
  • It is necessary for our legitimate interests to ensure that suitable candidates are selected for interview and employment.

To contact any employer references you have provided.

Necessary for our legitimate interests to ensure that suitable candidates are selected for employment.

Where your application is successful and you are offered a job with us, to create and send to you a contract of employment.

Necessary for our legitimate interests to ensure that appropriate contracts of employment are put in place with our employees.

To monitor and improve recruitment service quality, maintain records of recruitment enquiries and manage recruitment administration.

Necessary for our legitimate interests in administering and improving our recruitment processes.

To monitor and report on equality, diversity and inclusion within our recruitment processes, and to facilitate reasonable adjustments where required.

Necessary for our legitimate interests to monitor, validate and report on our recruitment processes, and necessary for compliance with employment law obligations, including consideration of reasonable adjustments.

Where we process special categories of personal data, we rely on one of the following lawful grounds.

  • Explicit consent – this is where we collect your explicit consent to process your data.
  • Legal employment rights and obligations – where processing is necessary to comply with legal obligations relating to employment.
  • Legal claims and rights – this is where we process your data to establish, exercise or defend legal claims or rights. This might be needed if you are involved in a dispute, grievance, disciplinary process, tribunal claim, or any legal proceedings.
  • Substantial public interest – where processing is necessary for reasons of public interest set out in law, such as promoting equality and diversity.

Criminal offence data is processed in accordance with Article 10 UK GDPR and Schedule 1 of the Data Protection Act 2018.

How long will we hold your information for once your application has been concluded?

Once you have created your online profile, whether your application is successful or unsuccessful, we will continue to hold your personal information and retain it:

  • For a period of 18 months from the date that you last accessed your profile (i.e. if you have not accessed your account during this period your profile will be deleted) save that information for applications in Northern Ireland will be kept for up to 4 years to comply with our legal duty under the Fair Employment and Treatment legislation; or
  • Until you otherwise close your online profile using the “Delete Profile” option in the “Settings” section of your profile.

Where you contact our recruitment team by email or telephone, records of those communications will be retained separately within our customer contact management systems for as long as reasonably necessary to manage the enquiry and comply with our legal obligations.

We will hold your personal information for this length of time to enable us to provide you with any feedback on your application, in case you have any other queries, to manage recruitment-related complaints and to defend potential employment claims. After the expiry of this period, your personal information shall be removed from our system and anonymised but we will retain general information for management information purposes (for example, any equality and diversity information provided to measure the success of our recruitment campaigns in terms of the number and sources of applications).

We will from time to time review our retention periods but we will only ever hold your personal information on our recruitment system for as long as we believe is necessary for reasons set out above or in line with our legal obligations or best practices.

Processing only the personal information that we need

Your personal information will only be processed to the extent that it is necessary for the specific purposes we tell you about.

Automated Processing

Our online recruitment process utilises a number of questions which, if answered in the negative, will automatically result in your application being rejected.  For example:

  • Whether you are legally eligible to work in the United Kingdom;
  • Whether you hold relevant qualifications and / or experience for the role you are applying for.

We use this automated process in order to fulfil our legal duties and for the purposes of our legitimate interests in order to efficiently administer our recruitment campaigns.

Who has access to your information?

We reserve the right to pass any or all of your personal information to the police or any other law enforcement agency for the purposes of:

  • Compliance with any of our legal obligations;
  • Crime detection or prevention;
  • Your misuse, or suspected misuse, of our website or your profile.

Where your contact relates to any legal proceedings or prospective legal proceedings against us, we may need to pass your personal information onto our insurers and legal advisers for the purposes of assessing any such proceedings. We may also be required to share your personal information if we are under a duty to do so in order to comply with any legal obligation or to protect our rights, property or the safety of our business, customers, suppliers or employees. This includes exchanging information with other companies and organisations for the purposes of fraud protection.

We may also share your personal information with third parties involved in the following activities:

  • Data hosting services for the operation of our recruitment systems;
  • Customer contact management and communication service providers used to manage recruitment enquiries, email correspondence, telephone recordings and call transcripts;
  • Background checking agencies (for example DBS);
  • The Home Office;
  • CV screening and summarisation using artificial intelligence;
  • Online ability and psychometric testing providers.

Apart from the circumstances set out above, we will not disclose your personal information to any third parties without your consent, unless we are satisfied that they are legally entitled to the information. Where we disclose your personal information to a third party, we will have regard to the data protection principles.

We will not:

  • Sell your personal information to third parties; or
  • Share your personal information with third parties, or use it ourselves, for marketing purposes (unless you have given your consent for us to do so).

Transferring your personal information outside the UK

We will not transfer your personal information outside the UK unless such transfer is compliant with UK GDPR.  This means that we cannot transfer any of your personal information outside the UK unless:

  • The UK Government has decided that another country or international organisation ensures an adequate level of protection for your personal information; or
  • The transfer of your personal information is subject to appropriate safeguards; or
  • One of the derogations in UK GDPR applies (including if you explicitly consent to the proposed transfer).

How we keep your data secure

We use reasonable and up to date security methods to keep your data secure and to prevent unauthorised or unlawful access to your information. All personal information you provide to us is stored on our, or our third party supplier’s, secure systems. 

Your rights

How can you find out about and update your information?

You have the right to ask for a copy of the personal information that we hold about you.  You also have the right to ask that we delete your personal information, although in some circumstances we are still entitled to keep it.

If you wish to do so, please contact us:

  • By email at data.protection@greggs.co.uk;
  • By post for the attention of the Data Protection Analyst, Greggs plc, Greggs House, Quorum Business Park, Newcastle upon Tyne, NE12 8BU.

In order to fulfil your request, we may need to first verify your identity.

Any questions regarding this Privacy Notice or to make a request for a copy of this Privacy Notice in an accessible format please get in touch using the same contact details above.

The accuracy of your information is also important to us.  If you change contact details or if you believe that any of the other personal information we hold is inaccurate, incomplete or out of date, you can update this via your online profile.  If you experience any problems with this, you can also contact us:

  • By post for the attention of the Recruitment Team, Greggs plc, Greggs House, Quorum Business Park, Newcastle upon Tyne, NE12 8BU;
  • By email at careers@greggs.co.uk;
  • By telephone on 0191 743 3488 and ask to speak with our Recruitment Team.

In addition to your rights set out elsewhere in this Privacy Notice, you also have the right to:

  • Request details from us of the recipients of your personal information or the categories of recipients of your personal information, if it is supplied by us to any third parties;
  • In certain circumstances have the processing of your personal information restricted;
  • In certain circumstances be provided with the personal information that you have supplied to us, in a portable format that can be transmitted to another company;
  • In certain circumstances not to be subject to a decision that is based solely on automated processing which would have a legal or significant impact on you.

If you wish to exercise any of the rights set out above, you must make the request in writing addressed to the "Data Protection Analyst" using one of the methods set out in the “How can you find out about and update your information?” section of this Privacy Notice.

Withdrawal of consent

If you have provided your consent for us to process your personal information, you have the right to withdraw your consent at any time. This will not affect the legality of our consent based use before you withdrew your consent. 

If you wish to exercise your right to withdraw your consent, you can either do so via your preference settings within your online profile or otherwise you must make the request in writing addressed to the "Data Protection Analyst" using one of the methods set out in the “How can you find out about and update your information?” section of this Privacy Notice.

The right to object

You have the right to object to our use of your personal information, or to ask us to delete, remove, or stop using your personal information if there is no need for us to keep it. This is known as the “right to be forgotten”.

There may be legal or other reasons why we need to keep or use your information, but please tell us if you think that we should not be using it.

We may sometimes be able to restrict the use of your personal information. This means that it can only be used for certain things, such as legal claims or to exercise legal rights. In this situation, we would not use or share your information in other ways while it is restricted.

If you object to our processing of any of your personal information, you must make the request in writing addressed to the “Data Protection Analyst” using one of the methods set out in the “How can you find out about and update your information?” section of this Privacy Notice.

Right to make a complaint

If you have any issues with our processing of your personal information and would like to make a complaint, you can contact our Data Protection Analyst or alternatively you may contact the Information Commissioner's Office on 0303 123 1113 or at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

You can also find further information about your rights and how to complain on the ICO website at ico.org.uk.