• This is Caravan’s privacy notice for job applicants.
• It covers Navarac Ltd (company number 08869694, trading as Caravan Restaurants and Vardo) and Caravan Coffee Roasters Ltd (company number 09220000), together “Caravan”, “we”, “us” or “our”, of Lambworks, North Road, London, N7 9DP.
• It explains what personal data we collect about you when you apply to join us, why, the lawful basis we rely on, how long we keep it, and the rights you have over it.
• We’ve written it to meet our obligations under UK data protection law (the UK GDPR and the Data Protection Act 2018).
• This notice applies to anyone who applies for a role with us, whether or not your application is successful.

Last updated: 02.11.2026

Data protection principles

UK GDPR sets out some core principles for handling personal data, and we stick to them. That means:

• Processing is fair, lawful and transparent.
• Data is collected for specific, explicit and legitimate purposes.
• Data collected is adequate, relevant and limited to what is necessary for the purposes of processing.
• Data is kept accurate and up to date.
• Data which is found to be inaccurate will be rectified or erased without delay.
• Data is not kept for longer than is necessary for its given purpose.
• Data is processed in a manner that ensures appropriate security of personal data, including protection against unauthorised or unlawful processing, accidental loss, destruction or damage by using appropriate technical or organisational measures.
• We comply with the relevant UK GDPR procedures for international transferring of personal data.

Types of data held

Personal data means any information that can identify you as an individual. It doesn’t include anonymous data, where you can’t be identified.

We collect, store and use several categories of personal data about candidates, to run an effective and fair recruitment process. We keep this data in recruitment files relating to each vacancy, and within our systems, including our Applicant Tracking System. It’s your responsibility to keep us up to date with any changes to your personal details. If your details change, let your recruitment contact know, or update them directly in our Applicant Tracking System.

Specifically, we collect, store and use the following types of data:

• Personal details such as names, previous names, title, address, phone numbers, email address, date of birth (if you provide it in your CV or applicant tracking system profile).
• Your photograph, if you include one in your CV or applicant tracking system profile.
• Your gender, if you provide it in your CV or applicant tracking system profile.
• Right to work documentation, which we check before you sign your contract.
• Whether you need any adjustments during the recruitment process.
• Information on your race and religion for equality monitoring purposes, if you choose to give it.
• Information gathered via the recruitment process such as that entered in a CV or included in a cover letter.
• References from former employers.
• Details on your education and employment history, etc.
• Driving licence, for roles that involve driving.
• Criminal convictions, for the roles described under “Criminal conviction data”.

If your CV or application includes other information we haven’t asked for, such as your marital status, we’ll hold it as part of your application but won’t use it to make recruitment decisions.

We collect some information later, when you accept an offer and sign your contract, such as your next of kin. See “Collecting your data”.

Collecting your data

You give us some of this directly, during your application and through the recruitment process.

Sometimes we get information about you from elsewhere too, such as recruitment agencies, previous employers when we take up references, TrustID (our right to work checks), a licensed criminal record check provider, publicly available information such as public social media profiles, or credit reference agencies.

If you’re successful, we’ll gather a bit more from you, like your bank details, next of kin information, any medical information we need and equality monitoring information such as your sexual orientation, through our applicant tracking system when you accept an offer and sign your contract. Some of this is optional, such as equality monitoring information. Our employee privacy notice explains how we use it.

Lawful basis for processing

The law on data protection allows us to process your data for certain reasons only. The information below categorises the types of data processing we undertake and the lawful basis we rely on.

Activity requiring your data	Lawful basis
Carrying out checks in relation to your right to work in the UK	Legal obligation
Making reasonable adjustments for disabled applicants and employees	Legal obligation
Making recruitment decisions in relation to both initial and subsequent employment, for example a promotion	Our legitimate interests, which are ensuring we make fair and effective recruitment decisions to resource our restaurants and support functions appropriately
Making decisions about salary and other benefits	Our legitimate interests, which are ensuring pay and benefits decisions are consistent, fair and affordable across the business
Making decisions about contractual benefits to provide to you	Our legitimate interests, which are making sure any contractual benefits we offer are decided fairly and consistently
Assessing training needs	Our legitimate interests, which are identifying and planning the training and development our people need to do their jobs well
Dealing with legal claims made against us	Our legitimate interests, which are defending our legal position and dealing with claims made against us
Preventing fraud	Our legitimate interests, which are protecting the business and our people from fraud and financial loss
Reviewing your application, contacting you and arranging interviews and trial shifts	Taking steps at your request before entering into a contract with you
Taking up references	Our legitimate interests, which are confirming your experience and suitability for the role
Equality monitoring	Our legitimate interests, which are checking that our recruitment process is fair and gives everyone an equal opportunity
Criminal record and driving checks for specific roles	See “Criminal conviction data”
Keeping your details on file for future vacancies	Your consent, which you can withdraw at any time

Special categories of data

Special categories of data are data relating to your:

• Health
• Sexual orientation
• Race
• Ethnic origin
• Religion
• Trade union membership
• Genetic and biometric data

We carry out processing activities using special category data:

• For the purposes of equal opportunities monitoring.
• To determine reasonable adjustments.

We will process special categories of data when the following applies:

• You have given explicit consent to the processing, for example when you choose to complete our equality monitoring form.
• We must process the data to carry out our legal obligations, for example making reasonable adjustments.
• We must process data for reasons of substantial public interest, for example checking our recruitment gives everyone an equal opportunity.
• You have already made the data public, for example on a public social media profile.

Failure to provide data

Your failure to provide us with data may mean that we are unable to fulfil our requirements for entering a contract of employment with you. This could include being unable to offer you employment or administer contractual benefits.

Criminal conviction data

We only collect criminal conviction information for two kinds of role: management roles where you would be the Designated Premises Supervisor (DPS) at one of our sites, and roles that involve driving for us. This data is usually collected at the recruitment stage, for example through screening questions. We use it to check your suitability for these specific roles, relying on the condition for employment, social security and social protection (Data Protection Act 2018, Schedule 1, Part 1, paragraph 1).

Who we share your data with

People at Caravan who need access to your data to do their jobs, for recruitment and right to work checks, can see the parts that are relevant to their role. Everyone with that kind of access is trained on handling data in line with UK GDPR.

Data is shared with third parties for the following reasons: administration of recruitment and verification of your right to work in the UK.

The third parties who will process your personal data for this purpose are Harri, the provider of our Applicant Tracking System, TrustID (right to work checks) and the licensed provider that carries out criminal record checks. We also share information with recruitment agencies that put you forward, and with your referees when we take up references.

We might also share your data if Caravan is sold or restructured, or where we’re legally required to.

We have data processing agreements in place with all these third parties, and they’re required to keep your data secure with the right technical and organisational measures.

We do not share your data with bodies outside of the UK and the European Economic Area (EEA).

Protecting your data

We know we need to keep your data safe from accidental loss, disclosure, destruction or misuse, and we’ve put processes in place to do exactly that.

Retention periods

We only keep your data for as long as we actually need it. If you’re not successful, we keep it for 24 months from the date of your application.

If you’ve told us you’re happy for us to keep your details on file for future vacancies, we’ll keep them for the same 24-month period. You can withdraw that consent at any time, we’ll stop processing your data for that purpose and there are no consequences for withdrawing it.

If you’re successful, your data will be kept and moved into the systems we use for our team. We have a separate privacy notice for employees, which we’ll give you.

Automated decision making

Automated decision-making means making a decision about you with no human involvement, for example using a computerised process. Our Applicant Tracking System can automatically score applications, but it never makes the final call. Every hiring decision is made by the hiring manager, so there’s always a human in the loop.

Your rights

You have the following rights in relation to the personal data we hold on you:

• The right to be informed about the data we hold on you and what we do with it.
• The right of access to the data we hold on you. More information on this can be found in our separate policy on subject access requests.
• The right for any inaccuracies in the data we hold on you, however they come to light, to be corrected (“rectification”).
• The right to have data deleted in certain circumstances (“erasure”).
• The right to restrict the processing of the data.
• The right to transfer the data we hold on you to another party (“portability”).
• The right to object to the processing of your data where we rely on our legitimate interests.
• The right not to be subject to decisions based solely on automated processing, and to ask for a person to review any such decision.

If you’ve given us consent to use your data, you can withdraw it at any time, and we’ll stop processing your data. In some cases, we may still be able to use it where we have another legitimate reason to do so.

Some of these rights only apply in certain circumstances. Making a request is free, and we’ll normally respond within one month.

If you wish to exercise any of the rights explained above, please contact peopleteam@caravanandco.com.

Making a complaint

Please contact us first at peopleteam@caravanandco.com. We’ll acknowledge your complaint within 30 days and tell you the outcome. If you’re not happy with the outcome, you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

Data protection contact

You can reach our data protection contact by contacting the People Team: peopleteam@caravanandco.com.

Other formats

If you need this notice in another format, email peopleteam@caravanandco.com.